CVE-2026-9589: CWE-862 Missing Authorization in Unblu inc. Unblu Spark

This vulnerability (CVE-2026-9589) affects Unblu Spark Collaboration Server versions >=7.0 and <8.37.0 on both on-premises and cloud deployments. The issue is a missing authorization check in configuration cascade operations, allowing authenticated attackers to read and write configuration properties of unauthorized entities. The Collaboration Server fails to verify user access rights to the configuration entities being accessed or modified. Under certain non-default validation settings, attackers can write configuration properties beyond their permission scope. Exploitation requires only an authenticated session and no additional user interaction. The CVSS 4.0 base score is 9.3, indicating critical severity with network attack vector, low attack complexity, no user interaction, and high impact on confidentiality, integrity, and availability.

An authenticated attacker can read and modify configuration properties of other users, accounts, and in cloud deployments, other customers' accounts, potentially leading to unauthorized disclosure and modification of sensitive configuration data. This can compromise the integrity and confidentiality of the affected entities' configurations and may impact service availability or behavior.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since this vulnerability requires an authenticated session, review and restrict user access privileges as a temporary mitigation. Monitor for vendor updates and apply official fixes once available.