Threats tagged 'ghsa-84g7-3jhg-7mmv'

Omnispace Agora Project versions up to 26.10.0 have a broken access control vulnerability in the isAutor() function. This function grants access rights based solely on object authorship without verifying if the user still belongs to the object's space. As a result, former members who authored objects can retain unauthorized read access after removal, causing persistent information disclosure.