EUVD-2026-100582
GHSA-j79f-gcw7-cjf8
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as low-privileged member
-
DeliveryInvoke actionVueEditUser user-edit action
-
ExploitBypass missing editRight() authorization check
-
ExecutionCreate unauthorized/privileged user accounts
-
ImpactEscalate privileges within application
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires an existing authenticated, non-administrative member account on the target Agora Project instance (PR:L) and the ability to invoke the user-edit action (actionVueEditUser) over the network; no user interaction or admin rights are needed. The specific weakness is the absence of an editRight() function-level authorization check on that action, so it is exploitable against default code in all versions before 26.10.0. The principal limiting factor is that the attacker must first hold a valid member login - purely external unauthenticated attackers cannot trigger it, making shared/multi-tenant or self-registration-enabled deployments the realistic risk surface. |
| Impact | This is a moderate-priority, authenticated privilege-escalation flaw rather than a critical internet-wide emergency. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N) is internally consistent with the description: network-reachable, low attack complexity, and crucially PR:L - the attacker must already be an authenticated, non-administrative member, which is the single largest limiting factor. The high integrity impact (VI:H) correctly reflects that the attacker can forge arbitrary user accounts and escalate privileges, while confidentiality is only low and availability unaffected. No EPSS score, CISA KEV listing, or public POC was provided, so there is no evidence of active or at-scale exploitation at this time; the 7.1 'High' rating is driven by impact, not by exploitation likelihood. The main signals agree (authenticated-but-easy, high integrity impact), and no conflicts are present, though the absence of EPSS/KEV/POC data means real-world exploitation probability cannot be quantified from the inputs. Net: a legitimate issue to patch promptly for any multi-tenant/shared deployment where untrusted users hold accounts, but not a drop-everything zero-day. |
| Exploit ScenarioDerived | A legitimate low-privileged member of an Agora Project workspace sends the user-edit request (actionVueEditUser) directly, which the application fails to gate with an editRight() authorization check. By doing so they create new user accounts - including accounts they control with elevated roles - effectively escalating their own privileges within the platform. No public exploit code was identified, but the attack requires only an existing authenticated session and a crafted request, making it trivial to script for anyone with member access. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 13, 2026
Authenticated privilege escalation in Omnispace's Agora Project before 26.10.0 allows any regular, non-administrative member to create new user accounts by directly invoking the user-edit action actionVueEditUser, which is missing the editRight() function-level authorization check that guards comparable administrative actions. The flaw is reachable over the network by an attacker who already holds a valid member login (CVSS vector PR:L, no user interaction required) and results in high integrity impact and limited confidentiality exposure, with the practical risk concentrated in self-registration-enabled, shared or multi-tenant deployments where member accounts are easy to obtain. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; a vendor patch is available in version 26.10.0, and the VulnCheck advisory classifies the weakness as broken function-level authorization (Authentication Bypass / Privilege Escalation).
RemediationAI
Vendor-released patch: upgrade to Agora Project 26.10.0 (or later), available from https://github.com/xech/agora-project/releases/tag/26.10; note that the published 26.10.0 release notes highlight two-factor authentication, notification-recipient ordering, and large-backup optimization but do not explicitly call out this authorization fix, so validate after upgrading that actionVueEditUser now enforces editRight() for non-administrative sessions before considering the instance remediated. If upgrading immediately is not possible, the most effective compensating control is to eliminate the attacker prerequisite: disable self-registration and any non-administrative account provisioning, which blocks new member accounts from being created (trade-off: legitimate onboarding must be handled manually by admins). Because exploitation requires an authenticated member session, restrict or disable unused member accounts and rotate credentials for any members who do not need access (trade-off: reduced collaboration access for real users). A reverse proxy or WAF rule that denies requests to the user-edit action (actionVueEditUser) unless the session carries administrative rights can interrupt exploitation, but such rules are brittle against parameter or path variation and risk breaking legitimate admin user management; the same caveat applies to temporarily removing the user-edit action from the application menu, which is only a usability reduction, not an authorization fix. Source-level remediation is small and low-risk: add the missing editRight() check at the top of actionVueEditUser before any account creation logic, mirroring the guard used by other administrative actions, and deploy it as a hotfix if the 26.10.0 upgrade cannot be scheduled. Finally, review existing user tables and audit logs for accounts created by non-administrative members, disable and delete any unauthorized accounts found, and monitor for repeated invocations of the user-edit action from low-privilege sessions as a detection measure.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-862 (Missing Authorization), specifically the absence of a function-level access-control check on the actionVueEditUser controller action. The naming convention indicates an action-dispatch web framework (typically PHP MVC) in which each request maps to an "action" method and sensitive operations are supposed to call a centralized authorization helper, editRight(), before performing privileged work. In the affected releases, actionVueEditUser executes account-creation/update logic without consulting that helper, so the authorization decision that normally distinguishes an administrator from a regular member is simply never made. This is a classic broken function-level authorization pattern: the endpoint is reachable and the session is valid, but the server fails to verify that the caller's role permits the operation. The CVSS 4.0 base score of 7.1 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N) reflects a network-reachable, low-complexity, low-privilege action with high integrity impact on the vulnerable component and no availability impact; the parallel CVSS 3.1 assessment (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N) is consistent, confirming the flaw is exploitable with an ordinary member account rather than by an anonymous internet attacker, since the attacker must first authenticate to obtain a session that can reach the action.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N
Authenticated member access is required so PR:L (never PR:N), network vector and low complexity match a direct request, with high integrity (account creation/privilege escalation), low confidentiality, and no availability impact.
Primary rating from Vendor (vulncheck).
CVSS VectorVendor: vulncheck
Lifecycle Timeline
2DescriptionCVE.org
Omnispace Agora Project before 26.10.0 contains a broken access control vulnerability that allows a regular, non-administrative member to create user accounts by invoking the user-edit action without a function-level authorization check. Attackers can exploit the missing editRight() enforcement in actionVueEditUser to create unauthorized user accounts, leading to privilege escalation.
Executive ViewAI
Omnispace's Agora Project versions before 26.10.0 contain an authenticated privilege escalation vulnerability that allows any regular member to create new user accounts, undermining account provisioning controls in shared or multi-tenant deployments. This flaw is particularly risky for organizations with self-registration enabled, as it could enable unauthorized access and data integrity issues. Leadership should prioritize patching to version 26.10.0 to prevent potential abuse of internal systems and maintain trust in multi-tenant environments.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Exploit-DB