https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 15 Oct 2026 11:43:10 +0000 https://db.gcve.eu/vuln/cve-2026-63174 <p><strong>Affected:</strong> Omnispace Agora Project</p> <p>Omnispace Agora Project before 26.10.0 contains a broken access control vulnerability that allows a space administrator to assign users into spaces outside their authority because the spaceAffectList affectation was performed without verifying the caller&#39;s rights to the target space. Attackers can exploit the missing readRight() check in the import flow&#39;s join INSERT to break tenant isolation and manipulate user-space assignments across unauthorized spaces.</p> <p><strong>Affected:</strong> Omnispace Agora Project</p> <p>Omnispace Agora Project before 26.10.0 contains a broken access control vulnerability that allows a space administrator to assign users into spaces outside their authority because the spaceAffectList affectation was performed without verifying the caller&#39;s rights to the target space. Attackers can exploit the missing readRight() check in the import flow&#39;s join INSERT to break tenant isolation and manipulate user-space assignments across unauthorized spaces.</p> https://db.gcve.eu/vuln/cve-2026-63174