EUVD-2026-80695
GHSA-3w65-9g38-h8jv
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as non-guest user
-
ExploitInvoke self-enrollment endpoint bypassing invitation/approval
-
ExecutionGrant self group-admin role
-
ImpactAccess and control existing access group data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V8 - Authorization Least privilege enforcement
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires a valid authenticated, non-guest account in Curiosity Workspace (PR:L) - guest accounts and unauthenticated attackers are excluded. The attacker must target an EXISTING access group, and exploitation abuses the enrollment path that should mandate an invitation or approval. No user interaction is needed (UI:N) and the vector is network-reachable (AV:N/AC:L). Limiting factors: impact is bounded to the targeted access group - it does NOT grant application-wide administrator rights nor root access to the application or host, so this is an insider/privilege-escalation risk rather than full-system takeover. |
| Impact | The vendor CVSS 4.0 score of 8.7 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H) rates this as high severity, driven by a low-complexity network vector with full VC:H/VI:H/VA:H impact. However, the description materially constrains that impact: the flaw lets an authenticated, non-guest user self-enroll as administrator/member of an EXISTING access group, but explicitly does NOT confer application-wide administrator privileges and cannot yield root/host compromise. The full-triad HIGH rating therefore appears somewhat generous relative to the stated blast radius, which is bounded to a single access group's resources rather than the whole application. There is no EPSS score, no CISA KEV listing, and no public exploit code referenced - the only source is the vendor advisory reported by Airbus. Exploitation status: no public exploit identified at time of analysis. Because PR:L requires a valid non-guest account, this is a privilege-escalation/insider-abuse risk rather than a pre-auth mass-exploitation candidate; it is a genuine priority for multi-tenant Curiosity Workspace deployments where access-group segregation is a security boundary, but the CVSS-vs-description tension (VA:H claimed while impact is scoped to one group) should be verified with the vendor. |
| Exploit ScenarioDerived | An authenticated non-guest user with a low-privilege account issues the group-enrollment request that normally requires an invitation or approval, adding themselves as administrator of an access group they should not belong to. They then read and modify that group's data and membership. No public proof-of-concept is available; exploitation requires only a valid, low-privilege application account. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 16, 2026
Authenticated non-guest users of Curiosity Workspace can escalate their privileges to administrator within an existing access group without an invitation or approval, as reported in CVE-2026-88817. The vendor rates this as high severity (CVSS 4.0 score 8.7), and our independent assessment confirms the impact is limited to the targeted access group-it does not grant application-wide administrator rights or root access to the host. No public exploit has been identified at the time of analysis, and a vendor advisory is available with potential remediation guidance.
RemediationAI
No vendor-released patch has been identified at the time of analysis. Users should monitor the vendor advisory at https://docs.curiosity.ai/security/advisories/cve-2026-88817 for updates. As a compensating control, administrators should audit existing access group memberships for unauthorized administrators and members, and restrict account creation to trusted individuals. Additionally, consider implementing external approval workflows for group enrollment until a patch is available, and monitor for suspicious enrollment events. Note that these mitigations may not fully address the root cause and could require additional administrative overhead.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability stems from improper privilege management (CWE-269) in Curiosity Workspace's access group enrollment process. The platform, identified by CPE cpe:2.3:a:curiosity_gmbh:curiosity_workspace:*:*:*:*:*:*:*:*, allows any authenticated non-guest user to join an existing access group as an administrator and member without the required invitation or approval. This bypasses intended access controls, enabling privilege escalation within that group's scope. The affected component is the group membership management mechanism, which fails to enforce invitation-based enrollment. Exploitation requires a valid non-guest account, and the impact is confined to the targeted group; it does not extend to application-wide administrative privileges or underlying host compromise. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N) indicates network reachability, low complexity, and high confidentiality, integrity, and availability impact within the group context.
Know when Curiosity Workspace gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Authenticated non-guest user (PR:L) over the network gains group-admin control of one access group's data (C:H/I:H); availability impact is not substantiated by the description, so A:N and S:U.
Primary rating from Vendor (airbus).
CVSS VectorVendor: airbus
DescriptionCVE.org
An authenticated, non-guest user of Curiosity Workspace could enroll themselves as an administrator and member of an existing access group without an invitation or approval.
It did not grant application-wide administrator privileges, and the vulnerability could not be used to obtain root access to the application or its underlying host.
Executive ViewAI
Curiosity Workspace contains a high-severity privilege escalation issue (CVE-2026-88817) that allows non-guest users to become administrators within an existing access group without invitation or approval. The impact is limited to the targeted access group and does not grant application-wide administrator rights or host root access, but it could still expose sensitive group data or workflows to unauthorized oversight. Leadership should care because affected groups may control critical business functions, and no vendor-released patch is identified at time of analysis, requiring interim controls while the vendor advisory is reviewed.
No vendor-released patch identified at time of analysis; review vendor advisory for potential remediation guidance, enforce least privilege by limiting non-guest membership in sensitive access groups, audit group administrator assignments, and monitor for unauthorized privilege changes within access groups.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Exploit-DB