{"id":"CVE-2026-63151","kind":"vulnerability","aliases":["CVE-2026-63151"],"related":[],"title":"Omnispace Agora: predictable calendar tokens expose private events to anyone","description":"Omnispace Agora Project through 26.10.0 contains a predictable token generation vulnerability that allows unauthenticated attackers to access private calendar data by exploiting a missing dateCrea value that causes the md5Id token to collapse to md5(calendarId.userId), both small enumerable integers. Attackers can compute valid tokens and request the misc&action=DisplayIcal endpoint with a forged md5Id to read any user's private calendar events without authentication.","summary":"Omnispace Agora Project through 26.10.0 builds its calendar access token from two small enumerable integers when a creation date is missing, so the token can be guessed. An unauthenticated attacker can forge the token and read any user's private calendar events through the DisplayIcal endpoint.","severity":"high","cvss":8.7,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Agora-Project","fixed":[],"affected":"<= 26.10.0","ecosystem":"vendor"}],"ecosystems":[],"tags":["calendar","omnispace-agora","other","self-hosted"],"not_affected_if":["unknown"],"how_to_check":"Check your Agora-Project version (shown in the admin/about page, or the release you installed). Versions up to and including 26.10.0 are listed as affected by the CVE. Also check whether the calendar iCal export (misc&action=DisplayIcal) is reachable from the internet; if it is, treat calendar events as readable by anyone.","fix":null,"status":"open","published_at":"2026-11-13T17:17:33+00:00","first_seen_at":"2026-11-13T17:48:02+00:00","triaged_at":"2026-11-13T17:48:42+00:00","updated_at":"2026-11-13T17:50:24+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-11-13T17:48:42Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Omnispace Agora: predictable calendar tokens expose private events to anyone","impact":"medium","summary":"Omnispace Agora Project through 26.10.0 builds its calendar access token from two small enumerable integers when a creation date is missing, so the token can be guessed. An unauthenticated attacker can forge the token and read any user's private calendar events through the DisplayIcal endpoint.","audience":"businesses","category":"other","nicknames":[],"who_cares":["omnispace-agora","calendar","self-hosted"],"confidence":0.7,"fix_status":"unknown","needs_auth":"no","worst_case":"attacker reads any user's private calendar events","analyst_note":"Confirm the fixed version and the exact trigger for the missing dateCrea value from the vendor or a source beyond NVD.","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"Teams running Omnispace Agora Project through 26.10.0 with calendar features exposed to the network. The sources do not say which configurations trigger the missing dateCrea value, so whether all installs are affected is unknown.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000687,"input_tokens":4604,"output_tokens":453,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm the fixed version and the exact trigger for the missing dateCrea value from the vendor or a source beyond NVD.","search":"'-2026':12A,15A '-63151':13A,16A '26.10.0':32B,78C 'access':36B,90C 'action':123C 'agora':2A,18A,23B,29B,75C 'agora-project':17A 'allow':86C 'anyon':10A 'attack':57B,88C,114C 'authent':139C 'build':33B 'calendar':4A,20B,35B,68B,92C,136C 'calendarid.userid':109C 'caus':101C 'collaps':106C 'comput':116C 'contain':79C 'creation':45B 'cve':11A,14A 'data':93C 'date':46B 'datecrea':98C 'display':72B,124C 'endpoint':73B,125C 'enumer':41B,112C 'event':8A,69B,137C 'exploit':95C 'expos':6A 'forg':59B,128C 'generat':83C 'guess':54B 'host':27B 'integ':42B,113C 'md5':108C 'md5id':103C,129C 'misc':122C 'miss':48B,97C 'omnispac':1A,22B,28B,74C 'omnispace-agora':21B 'predict':3A,81C 'privat':7A,67B,91C,135C 'project':19A,30B,76C 'read':63B,131C 'request':120C 'self':26B 'self-host':25B 'small':40B,111C 'token':5A,37B,51B,61B,82C,104C,118C 'two':39B 'unauthent':56B,87C 'user':65B,133C 'valid':117C 'valu':99C 'vulner':84C 'without':138C","nicknames":[],"mitigations":[],"who_affected":"Self-hosted Omnispace / Agora-Project installs up to 26.10.0 that use the calendar module and are reachable from the network. The CVE text says the token falls back to md5(calendarId.userId) when an object's dateCrea value is missing; no source says which calendars or installs lack that value, so assume any could. Managed Omnispace.fr hosting is run by the vendor and the sources do not say whether it is affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":["agoraproject"],"ptokens":["agora","project"],"labels":["calendar","high","omnispaceagora","other","selfhosted"],"campaign_type":null,"search_a":"'-2026':12A,15A '-63151':13A,16A 'agora':2A,18A 'agora-project':17A 'anyon':10A 'calendar':4A 'cve':11A,14A 'event':8A 'expos':6A 'omnispac':1A 'predict':3A 'privat':7A 'project':19A 'token':5A","search_b":"'26.10.0':32B 'access':36B 'agora':23B,29B 'attack':57B 'build':33B 'calendar':20B,35B,68B 'creation':45B 'date':46B 'display':72B 'endpoint':73B 'enumer':41B 'event':69B 'forg':59B 'guess':54B 'host':27B 'integ':42B 'miss':48B 'omnispac':22B,28B 'omnispace-agora':21B 'privat':67B 'project':30B 'read':63B 'self':26B 'self-host':25B 'small':40B 'token':37B,51B,61B 'two':39B 'unauthent':56B 'user':65B","search_c":"'26.10.0':78C 'access':90C 'action':123C 'agora':75C 'allow':86C 'attack':88C,114C 'authent':139C 'calendar':92C,136C 'calendarid.userid':109C 'caus':101C 'collaps':106C 'comput':116C 'contain':79C 'data':93C 'datecrea':98C 'display':124C 'endpoint':125C 'enumer':112C 'event':137C 'exploit':95C 'forg':128C 'generat':83C 'integ':113C 'md5':108C 'md5id':103C,129C 'misc':122C 'miss':97C 'omnispac':74C 'predict':81C 'privat':91C,135C 'project':76C 'read':131C 'request':120C 'small':111C 'token':82C,104C,118C 'unauthent':87C 'user':133C 'valid':117C 'valu':99C 'vulner':84C 'without':138C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T17:17:33+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-63151","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63151","severity":null,"published_at":"2026-11-13T17:17:33+00:00","modified_at":"2026-11-13T17:17:33+00:00","first_seen_at":"2026-11-13T17:48:02+00:00","fetched_at":"2026-11-13T17:48:02+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-63151:3913","url":"https://github.com/xech/agora-project/releases/tag/26.10","severity":null,"published_at":"2026-11-13T17:50:24+00:00","modified_at":"2026-11-13T17:50:24+00:00","first_seen_at":"2026-11-13T17:50:24+00:00","fetched_at":"2026-11-13T17:50:24+00:00","note":"Only NVD/VulnCheck text found; no vendor advisory for this CVE. Sibling batch (Oct 13) says fixed in 26.10, but this CVE says 'through 26.10.0', so the 26.10.x releases (26.10.2 tag, 26.10.5 forum post) are not confirmed fixed. Fixed version and the cause of missing dateCrea are unconfirmed; nothing verified. Check the akailabs disclosure or the xech/agora-project commits for DisplayIcal to settle it.","cites":["https://github.com/xech/agora-project/releases/tag/26.10","https://www.vulncheck.com/advisories/omnispace-agora-project-broken-access-control-via-isautor"]}],"documents":[{"id":148154,"url":"https://github.com/xech/agora-project/releases/tag/26.10","title":"Agora Project 26.10.2 release","kind":"release","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null},{"id":148155,"url":"https://www.vulncheck.com/advisories/omnispace-agora-project-broken-access-control-via-isautor","title":"VulnCheck: Agora Project <= 26.10.0 isAutor() (sibling CVE-2026-63173, same batch)","kind":"advisory","source":"analyst","publisher":"research","text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}