---
id: "CVE-2026-63151"
page: "https://infrastack.ai/live/CVE-2026-63151"
kind: "vulnerability"
aliases: ["CVE-2026-63151"]
title: "Omnispace Agora: predictable calendar tokens expose private events to anyone"
severity: "high"
cvss: 8.7
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "Agora-Project", "fixed": [], "affected": "<= 26.10.0", "ecosystem": "vendor"}]
ecosystems: []
tags: ["calendar", "omnispace-agora", "other", "self-hosted"]
not_affected_if: ["unknown"]
published_at: "2026-11-13T17:17:33+00:00"
first_seen_at: "2026-11-13T17:48:02+00:00"
updated_at: "2026-11-13T17:50:24+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-63151", "first_seen_at": "2026-11-13T17:48:02+00:00"}, {"source": "analyst", "url": "https://github.com/xech/agora-project/releases/tag/26.10", "first_seen_at": "2026-11-13T17:50:24+00:00", "cites": ["https://github.com/xech/agora-project/releases/tag/26.10", "https://www.vulncheck.com/advisories/omnispace-agora-project-broken-access-control-via-isautor"]}]
exploit_sources: []
---

# Omnispace Agora: predictable calendar tokens expose private events to anyone

Link for people: https://infrastack.ai/live/CVE-2026-63151 (this .md is for agents)

Omnispace Agora Project through 26.10.0 builds its calendar access token from two small enumerable integers when a creation date is missing, so the token can be guessed. An unauthenticated attacker can forge the token and read any user's private calendar events through the DisplayIcal endpoint.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Agora-Project affected <= 26.10.0 fixed no fixed version listed

## How to check

Check your Agora-Project version (shown in the admin/about page, or the release you installed). Versions up to and including 26.10.0 are listed as affected by the CVE. Also check whether the calendar iCal export (misc&action=DisplayIcal) is reachable from the internet; if it is, treat calendar events as readable by anyone.

## Timeline

- 2026-11-13T17:48:02+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-63151
- 2026-11-13T17:50:24+00:00 analyst https://github.com/xech/agora-project/releases/tag/26.10 — Only NVD/VulnCheck text found; no vendor advisory for this CVE. Sibling batch (Oct 13) says fixed in 26.10, but this CVE says 'through 26.10.0', so the 26.10.x releases (26.10.2 tag, 26.10.5 forum post) are not confirmed fixed. Fixed version and the cause of missing dateCrea are unconfirmed; nothing verified. Check the akailabs disclosure or the xech/agora-project commits for DisplayIcal to settle it.

## Documents

- [mentions] Agora Project 26.10.2 release https://github.com/xech/agora-project/releases/tag/26.10
- [mentions] VulnCheck: Agora Project <= 26.10.0 isAutor() (sibling CVE-2026-63173, same batch) https://www.vulncheck.com/advisories/omnispace-agora-project-broken-access-control-via-isautor

## From the sources

Omnispace Agora Project through 26.10.0 contains a predictable token generation vulnerability that allows unauthenticated attackers to access private calendar data by exploiting a missing dateCrea value that causes the md5Id token to collapse to md5(calendarId.userId), both small enumerable integers. Attackers can compute valid tokens and request the misc&action=DisplayIcal endpoint with a forged md5Id to read any user's private calendar events without authentication.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_