CVE-2026-63163: Authorization Bypass Through User-Controlled Key in Omnispace Agora Project

Omnispace Agora Project before version 26.10.0 contains a broken access control vulnerability in the MobileFileDownload route. Instead of enforcing proper authorization checks, the system accepts an md5 hash of the filename as a token. Attackers can guess or determine filenames, compute their md5 hashes, and use these tokens to download arbitrary protected files without authentication, resulting in unauthorized information disclosure.

This vulnerability allows unauthenticated attackers to bypass access controls and download arbitrary files from the system. The impact is unauthorized information disclosure of potentially sensitive files. There is no indication of privilege escalation, data modification, or denial of service from the provided data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the MobileFileDownload route and monitor for suspicious access patterns involving md5 tokens. Avoid relying on predictable tokens for authorization.