AGORA-PROJECT · CVE-2026-63151 · Other
NO FIX YET
Omnispace Agora Project through 26.10.0 builds its calendar access token from two small enumerable integers when a creation date is missing, so the token can be guessed. An unauthenticated attacker can forge the token and read any user's private calendar events through the DisplayIcal endpoint.
first public Nov 13, 2026 · 2 sources
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Self-hosted Omnispace / Agora-Project installs up to 26.10.0 that use the calendar module and are reachable from the network. The CVE text says the token falls back to md5(calendarId.userId) when an object's dateCrea value is missing; no source says which calendars or installs lack that value, so assume any could. Managed Omnispace.fr hosting is run by the vendor and the sources do not say whether it is affected.
Not affected if unknown
Who cares calendar, omnispace-agora, self-hosted
26.10.0 are listed as affected by the CVEUnknown from the sources.
Omnispace Agora Project through 26.10.0 contains a predictable token generation vulnerability that allows unauthenticated attackers to access private calendar data by exploiting a missing dateCrea value that causes the md5Id token to collapse to md5(calendarId.userId), both small enumerable integers. Attackers can compute valid tokens and request the misc&action=DisplayIcal endpoint with a forged md5Id to read any user's private calendar events without authentication.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.