Threats tagged 'ghsa-jw74-pqqp-gj46'

Omnispace Agora Project versions before 26.10.0 have a broken access control vulnerability that allows a space administrator to assign users to spaces beyond their authorized scope. This occurs because the system does not verify the caller's rights when performing space affectations, specifically missing a readRight() check during the import flow's join INSERT operation. Exploiting this flaw can break tenant isolation and enable unauthorized manipulation of user-space assignments.