CVE-2026-63174: Missing Authorization in Omnispace Agora Project

Omnispace Agora Project before version 26.10.0 contains a broken access control vulnerability (CVE-2026-63174) where the spaceAffectList affectation is performed without verifying the caller's authorization to the target space. This missing readRight() check in the import flow's join INSERT operation allows a space administrator to assign users into unauthorized spaces, breaking tenant isolation and enabling manipulation of user-space assignments across tenants.

An attacker with space administrator privileges can exploit this vulnerability to assign users to spaces they are not authorized to access. This breaks tenant isolation, potentially allowing unauthorized access or manipulation of data across different spaces within the Agora Project environment. The CVSS 4.0 base score is 8.6, indicating a high severity impact with network attack vector, low attack complexity, no privileges required beyond space administrator, and no user interaction needed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict space administrator privileges carefully and monitor user-space assignments for anomalies. Avoid granting excessive permissions to space administrators to reduce risk.