This vulnerability (CWE-269 Improper Privilege Management) in Curiosity Workspace version 26.8.70362 permits an authenticated non-guest user to elevate their privileges by enrolling as an administrator and member of an existing access group without proper authorization. The flaw does not extend to granting full application-wide administrator rights or root access to the underlying system. The CVSS 4.0 score is 8.7 (high severity), reflecting network attack vector, low attack complexity, no user interaction, and high impacts on confidentiality, integrity, and availability. No patch or remediation information is provided, and it is not a cloud service, so remediation responsibility lies with the vendor and users.

An authenticated non-guest user can gain unauthorized administrative membership within an existing access group, potentially allowing elevated access to resources controlled by that group. However, this does not confer full application-wide administrator privileges or root access to the host system, limiting the scope of impact to group-level privilege escalation within the application.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix information is provided, users should monitor vendor communications for updates. In the meantime, restrict authenticated user privileges and review access group membership policies to mitigate unauthorized privilege escalation.