Agora Project CVE-2026-63174

Requires an authenticated account with space-administrator privileges on at least one space in a multi-tenant Agora Project deployment (versions before 26.10.0). Exploitation occurs through the user import flow's join INSERT, where the spaceAffectList affectation omits the readRight() authorization check on the target space, allowing assignment of users into spaces outside the admin's authority. Limiting factors: the attacker must already hold space-admin rights (no anonymous or standard-user path), the flaw matters chiefly in shared/multi-tenant installations where tenant isolation is relied upon, and single-tenant or single-space deployments have little to no exposure.

This is a genuine but conditional priority. The input CVSS 4.0 vector (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N) scores 8.6 (High): network-reachable, low attack complexity, no user interaction, but PR:L - meaning exploitation requires an already-authenticated space administrator account, not an anonymous remote attacker. The impact is high to confidentiality and integrity (cross-tenant visibility and manipulation of user-space assignments) with no availability impact (VA:N), consistent with a CWE-862 missing-authorization flaw rather than code execution. Mitigating signals: a fixed version (26.10.0) is available from the vendor, there is no CISA KEV listing (not actively exploited per available data), no public exploit code identified, and no EPSS score was supplied so widespread-exploitation probability cannot be quantified. No SSVC decision data was provided. The signals are internally consistent (no CVSS-vs-description conflict), but note the 'Authentication Bypass' tag overstates the issue - the attacker must already hold space-admin privileges, so this is a privilege/authorization-scope escalation across tenants, not a pre-auth bypass. Net: a meaningful multi-tenant isolation risk for operators running Agora Project below 26.10.0, tempered by the authenticated-admin prerequisite and absence of exploitation evidence.

An authenticated space administrator on a shared multi-tenant Agora Project instance abuses the user import/join flow, which performs the spaceAffectList affectation without a readRight() check on the target space. By submitting a crafted assignment, the admin assigns users into spaces they have no authority over, breaching tenant isolation and manipulating membership across unauthorized spaces. No public exploit code has been identified at time of analysis.