Unblu Spark CVE-2026-9589

Requires an authenticated session as any registered/low-privilege user (PR:L) against the Unblu Collaboration Server; no user interaction is needed. The core defect - reading and changing configuration of entities the attacker does not own (other users, other accounts, and in Unblu Cloud other customers' accounts) - works against standard deployments because the server omits the ownership check entirely. The expanded capability to write configuration properties the user is not permitted to edit in any scope is gated by a non-default precondition: 'certain non-default configuration validation settings' must be in effect. Limiting factors for defenders: valid account credentials are mandatory (no pre-auth path), the elevated write primitive depends on non-default validation configuration, and only Unblu Spark versions 7.0 through 8.36.1-hotfix.0 are affected; the cross-customer impact is specific to Unblu Cloud multi-tenant deployments.

This is a genuine high-priority issue, not a CVSS-inflated one. The vendor-assigned CVSS 4.0 vector (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N) describes a network-reachable, low-complexity flaw requiring only a low-privileged authenticated session and no user interaction, with high impact to vulnerable-system confidentiality, integrity and availability (VC:H/VI:H/VA:H) and high subsequent-system integrity/availability (SI:H/SA:H) reflecting the cross-tenant/cross-account blast radius. The CWE-862 (Missing Authorization) root cause is consistent with the description: the Collaboration Server simply fails to verify that the requesting user owns the entity whose configuration is being read or written. The alignment between the description and CVSS vector is strong, so there is no network-vs-local contradiction to flag. The key tempering signals are missing rather than conflicting: no EPSS score, no CISA KEV listing, and no public POC were provided, so exploitation likelihood cannot be quantified - exploitation status is therefore 'no public exploit identified at time of analysis' and must not be read as active exploitation. The privilege requirement (PR:L - any registered/authenticated user) is the main limiter, meaning this is not a pre-auth internet-wide worm candidate, but in a multi-tenant SaaS (Unblu Cloud) context the ability for one authenticated customer to reach other customers' accounts makes it a serious isolation-breaking bug that warrants prompt patching.

An attacker with any valid low-privilege Unblu account authenticates to the Collaboration Server and issues configuration read/write operations targeting entities (other users, other accounts, or in Unblu Cloud, other customers' accounts) that they do not own. Because the server performs no authorization check on the target entity, the attacker reads sensitive configuration and, where non-default validation settings are present, overwrites configuration properties in any scope. No public exploit code was identified at time of analysis, but exploitation is low-complexity and requires no user interaction once authenticated.