Omnispace Agora Project EUVD-2026-100576

Exploitation requires that the Omnispace Agora Project MobileFileDownload route be network-reachable (e.g. the mobile file-download functionality is enabled/exposed), and that the attacker can guess or determine valid stored filenames, since the forged token is md5(filename). No authentication, user interaction, or special privileges are needed (PR:N/UI:N against affected versions before 26.10.0). The main limiting factor is filename predictability - files with random or non-guessable names are harder to retrieve - and reachability of the mobile endpoint; impact is confined to confidentiality (read-only disclosure), with no integrity or availability effect.

This is a genuine, actionable priority rather than an inflated high-CVSS score. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H) describes a network-reachable, low-complexity, fully unauthenticated flaw with high confidentiality impact - and the CWE-639 (IDOR) nature means exploitation is trivial once the md5(filename) tokenization scheme is understood. The SSVC decision framework reinforces this: Automatable=yes (the token is a deterministic md5 of a guessable filename, so an attacker can script enumeration) and Technical Impact=partial (read-only disclosure, no integrity/availability loss, consistent with VC:H/VI:N/VA:N). The one signal that tempers urgency is SSVC Exploitation=none: there is no CISA KEV listing and no POC referenced in the provided data, so there is no public exploit identified at time of analysis and no confirmed active exploitation. The practical risk is therefore 'easy to weaponize but not yet observed being exploited' - the low barrier and automatable nature mean POC/exploit development is likely if the product is targeted, so patching to 26.10.0 should not be deferred. No conflicting signals were found between the CVSS vector and the description; both agree on remote, unauthenticated, confidentiality-only impact.

A remote, unauthenticated attacker identifies the MobileFileDownload endpoint, guesses or enumerates likely stored filenames, and computes md5(filename) to forge the access token that the route accepts in place of a real authorization check. Submitting that token returns the protected file, letting the attacker harvest documents without any credentials. No public exploit is identified at time of analysis, but the deterministic token scheme makes scripted enumeration straightforward (SSVC Automatable=yes).