{"id":"CVE-2026-63164","kind":"vulnerability","aliases":["CVE-2026-63164"],"related":[],"title":"Omnispace Agora: authenticated users can read other users' private mail","description":"Omnispace Agora Project through 26.10.0 contains an insecure direct object reference vulnerability that allows authenticated attackers to access another user's private mail by supplying a crafted reloadMailTypeId parameter to Ctrl::getCurObj() without a readRight() ownership check in CtrlMail.php. Attackers can manipulate the mail identifier value, such as reloadMailTypeId=mail-1, to retrieve the title and body of private messages belonging to other users, resulting in unauthorized disclosure of sensitive communications.","summary":"Omnispace Agora Project through 26.10.0 fails to check mail ownership when a crafted reloadMailTypeId parameter is supplied to Ctrl::getCurObj() in CtrlMail.php. An logged-in attacker can read the title and body of other users' private messages.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Agora Project","fixed":[],"affected":"<= 26.10.0","ecosystem":"vendor"}],"ecosystems":[],"tags":["idor","omnispace-agora","other","php","self-hosted"],"not_affected_if":["auth-required"],"how_to_check":"Check your Agora Project version (Admin > About, or the version shown in the footer). Versions up to and including 26.10.0 are listed as affected. Whether 26.10.5 fixes it is unconfirmed: the release notes don't say.","fix":"unknown: no vendor advisory found. Latest release is 26.10.5 (https://github.com/xech/agora-project/releases) but its notes don't mention this issue. Until confirmed, limit accounts and the Mail module.","status":"open","published_at":"2026-11-13T17:17:33+00:00","first_seen_at":"2026-11-13T17:48:02+00:00","triaged_at":"2026-11-13T17:48:51+00:00","updated_at":"2026-11-13T17:50:20+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-11-13T17:48:51Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Omnispace Agora: authenticated users can read other users' private mail","impact":"medium","summary":"Omnispace Agora Project through 26.10.0 fails to check mail ownership when a crafted reloadMailTypeId parameter is supplied to Ctrl::getCurObj() in CtrlMail.php. An logged-in attacker can read the title and body of other users' private messages.","audience":"businesses","category":"other","nicknames":[],"who_cares":["omnispace-agora","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Attacker reads other users' private mail titles and bodies","analyst_note":"Confirm the fixed version and any setting or patch from the vendor or NVD entry, since the sources list only the affected range through 26.10.0.","how_to_check":"- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["auth-required"],"who_is_affected":"Teams running Omnispace Agora Project up to version 26.10.0 where users have accounts on the same instance. The sources do not say which deployments are exposed beyond the authenticated mail feature. unknown","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.00069,"input_tokens":4633,"output_tokens":453,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm the fixed version and any setting or patch from the vendor or NVD entry, since the sources list only the affected range through 26.10.0.","search":"'-1':116C '-2026':12A,15A '-63164':13A,16A '26.10.0':32B,70C 'access':83C 'agora':2A,17A,22B,29B,67C 'allow':79C 'anoth':84C 'attack':54B,81C,105C 'authent':3A,80C 'belong':126C 'bodi':60B,122C 'check':35B,102C 'communic':136C 'contain':71C 'craft':40B,92C 'ctrl':46B,96C 'ctrlmail.php':49B,104C 'cve':11A,14A 'direct':74C 'disclosur':133C 'fail':33B 'getcurobj':47B,97C 'host':27B 'identifi':110C 'idor':19B 'insecur':73C 'log':52B 'logged-in':51B 'mail':10A,36B,88C,109C,115C 'manipul':107C 'messag':65B,125C 'object':75C 'omnispac':1A,21B,28B,66C 'omnispace-agora':20B 'ownership':37B,101C 'paramet':42B,94C 'php':24B 'privat':9A,64B,87C,124C 'project':18A,30B,68C 'read':6A,56B 'readright':100C 'refer':76C 'reloadmailtypeid':41B,93C,114C 'result':130C 'retriev':118C 'self':26B 'self-host':25B 'sensit':135C 'suppli':44B,90C 'titl':58B,120C 'unauthor':132C 'user':4A,8A,63B,85C,129C 'valu':111C 'vulner':77C 'without':98C","nicknames":[],"mitigations":[],"who_affected":"Self-hosted Omnispace Agora Project instances running 26.10.0 or earlier, where several users share one instance and use the Mail module. Any logged-in user can read other users' private mail title and body by changing the mail id. Single-user instances, or ones without the Mail module in use, are lower risk.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["agoraproject","project"],"ptokens":["agora","project"],"labels":["high","idor","omnispaceagora","other","php","selfhosted"],"campaign_type":null,"search_a":"'-2026':12A,15A '-63164':13A,16A 'agora':2A,17A 'authent':3A 'cve':11A,14A 'mail':10A 'omnispac':1A 'privat':9A 'project':18A 'read':6A 'user':4A,8A","search_b":"'26.10.0':32B 'agora':22B,29B 'attack':54B 'bodi':60B 'check':35B 'craft':40B 'ctrl':46B 'ctrlmail.php':49B 'fail':33B 'getcurobj':47B 'host':27B 'idor':19B 'log':52B 'logged-in':51B 'mail':36B 'messag':65B 'omnispac':21B,28B 'omnispace-agora':20B 'ownership':37B 'paramet':42B 'php':24B 'privat':64B 'project':30B 'read':56B 'reloadmailtypeid':41B 'self':26B 'self-host':25B 'suppli':44B 'titl':58B 'user':63B","search_c":"'-1':116C '26.10.0':70C 'access':83C 'agora':67C 'allow':79C 'anoth':84C 'attack':81C,105C 'authent':80C 'belong':126C 'bodi':122C 'check':102C 'communic':136C 'contain':71C 'craft':92C 'ctrl':96C 'ctrlmail.php':104C 'direct':74C 'disclosur':133C 'getcurobj':97C 'identifi':110C 'insecur':73C 'mail':88C,109C,115C 'manipul':107C 'messag':125C 'object':75C 'omnispac':66C 'ownership':101C 'paramet':94C 'privat':87C,124C 'project':68C 'readright':100C 'refer':76C 'reloadmailtypeid':93C,114C 'result':130C 'retriev':118C 'sensit':135C 'suppli':90C 'titl':120C 'unauthor':132C 'user':85C,129C 'valu':111C 'vulner':77C 'without':98C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T17:17:33+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-63164","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63164","severity":null,"published_at":"2026-11-13T17:17:33+00:00","modified_at":"2026-11-13T17:17:33+00:00","first_seen_at":"2026-11-13T17:48:02+00:00","fetched_at":"2026-11-13T17:48:02+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-63164:3912","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63164","severity":null,"published_at":"2026-11-13T17:50:20+00:00","modified_at":"2026-11-13T17:50:20+00:00","first_seen_at":"2026-11-13T17:50:20+00:00","fetched_at":"2026-11-13T17:50:20+00:00","note":"NVD lists affected through 26.10.0 (IDOR, reloadMailTypeId, missing readRight in CtrlMail.php). No vendor advisory or fix found. Sibling CVEs (63156, 63172, 63174) were fixed in 26.10.0, but this one is listed as 'through 26.10.0', so 26.10.0 itself looks vulnerable. Latest release seen is 26.10.5 (GitHub releases, notes don't mention this fix). Fix is unknown; nothing verified.","cites":["https://nvd.nist.gov/vuln/detail/CVE-2026-63164","https://github.com/xech/agora-project/releases"]}],"documents":[{"id":148152,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63164","title":"NVD CVE-2026-63164","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":148153,"url":"https://github.com/xech/agora-project/releases","title":"xech/agora-project releases (latest 26.10.5)","kind":"release","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}