https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 14 Oct 2026 23:15:01 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-63174 <p>Omnispace Agora Project before 26.10.0 contains a broken access control vulnerability that allows a space administrator to assign users into spaces outside their authority because the spaceAffectList affectation was performed without verifying the caller&#39;s rights to the target space. Attackers can exploit the missing readRight() check in the import flow&#39;s join INSERT to break tenant isolation and manipulate user-space assignments across unauthorized spaces.</p> <p>Omnispace Agora Project before 26.10.0 contains a broken access control vulnerability that allows a space administrator to assign users into spaces outside their authority because the spaceAffectList affectation was performed without verifying the caller&#39;s rights to the target space. Attackers can exploit the missing readRight() check in the import flow&#39;s join INSERT to break tenant isolation and manipulate user-space assignments across unauthorized spaces.</p> https://db.gcve.eu/vuln/fkie_cve-2026-63174 https://db.gcve.eu/vuln/ghsa-jw74-pqqp-gj46 <p>Omnispace Agora Project before 26.10.0 contains a broken access control vulnerability that allows a space administrator to assign users into spaces outside their authority because the spaceAffectList affectation was performed without verifying the caller&#39;s rights to the target space. Attackers can exploit the missing readRight() check in the import flow&#39;s join INSERT to break tenant isolation and manipulate user-space assignments across unauthorized spaces.</p> <p>Omnispace Agora Project before 26.10.0 contains a broken access control vulnerability that allows a space administrator to assign users into spaces outside their authority because the spaceAffectList affectation was performed without verifying the caller&#39;s rights to the target space. Attackers can exploit the missing readRight() check in the import flow&#39;s join INSERT to break tenant isolation and manipulate user-space assignments across unauthorized spaces.</p> https://db.gcve.eu/vuln/ghsa-jw74-pqqp-gj46