Agora Project CVE-2026-63153

Exploitation requires (1) a reachable Agora Project instance running a version before 26.10.0, and (2) the attacker possessing a valid authenticated account on that instance (CVSS PR:L) - it is not exploitable by fully unauthenticated outsiders. The specific trigger is invoking the setAffectations() function with an attacker-chosen target space identifier; the function fails to verify that the caller holds rights over that supplied space, so the practical prerequisite is simply any login plus the ability to submit the affectation request. Limiting factors: a prior account/credential is mandatory, making this most dangerous in multi-tenant or shared-hosting deployments where untrusted users coexist; single-tenant or tightly-controlled-user instances face lower realistic risk. No special non-default configuration or user interaction is needed.

The input provides a CVSS 4.0 vector (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N, base 8.6) describing network-reachable, low-complexity exploitation requiring low privileges (PR:L) and no user interaction - meaning any authenticated tenant user can trigger it remotely against a running instance. No EPSS score, CISA KEV entry, SSVC decision, or public POC was supplied, so there is no evidence of active or at-scale exploitation; exploitation status is 'no public exploit identified at time of analysis.' The high VC/VI (confidentiality and integrity) reflects the core harm: writing access-right records for arbitrary, caller-supplied target spaces breaks tenant isolation. The signals are internally consistent (authenticated-but-trivial authorization flaw, no availability impact), so this is a genuine priority for any multi-tenant Agora Project deployment despite the absence of exploitation telemetry - but the real-world urgency is tempered by the product's limited deployment footprint and the PR:L requirement (an attacker needs a valid account first). No conflicts exist between the CVSS vector and the description; both agree on authenticated remote access with no availability impact.

An attacker holding any low-privileged account on a shared Agora Project instance calls setAffectations() and supplies the identifier of a space belonging to another tenant or a restricted area they have no rights to. Because the function never verifies the caller's rights over the supplied target space, the attacker inserts access-right records granting themselves (or confederates) entry, then reads or modifies the previously isolated content. No public exploit code is identified, but the flaw is a straightforward object-reference authorization bypass requiring only a crafted authenticated request.