---
id: "CVE-2026-63164"
page: "https://infrastack.ai/live/CVE-2026-63164"
kind: "vulnerability"
aliases: ["CVE-2026-63164"]
title: "Omnispace Agora: authenticated users can read other users' private mail"
severity: "high"
cvss: 7.1
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "Agora Project", "fixed": [], "affected": "<= 26.10.0", "ecosystem": "vendor"}]
ecosystems: []
tags: ["idor", "omnispace-agora", "other", "php", "self-hosted"]
not_affected_if: ["auth-required"]
published_at: "2026-11-13T17:17:33+00:00"
first_seen_at: "2026-11-13T17:48:02+00:00"
updated_at: "2026-11-13T17:50:20+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-63164", "first_seen_at": "2026-11-13T17:48:02+00:00"}, {"source": "analyst", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-63164", "first_seen_at": "2026-11-13T17:50:20+00:00", "cites": ["https://nvd.nist.gov/vuln/detail/CVE-2026-63164", "https://github.com/xech/agora-project/releases"]}]
exploit_sources: []
---

# Omnispace Agora: authenticated users can read other users' private mail

Link for people: https://infrastack.ai/live/CVE-2026-63164 (this .md is for agents)

Omnispace Agora Project through 26.10.0 fails to check mail ownership when a crafted reloadMailTypeId parameter is supplied to Ctrl::getCurObj() in CtrlMail.php. An logged-in attacker can read the title and body of other users' private messages.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Agora Project affected <= 26.10.0 fixed no fixed version listed

## How to check

Check your Agora Project version (Admin > About, or the version shown in the footer). Versions up to and including 26.10.0 are listed as affected. Whether 26.10.5 fixes it is unconfirmed: the release notes don't say.

## Fix

unknown: no vendor advisory found. Latest release is 26.10.5 (https://github.com/xech/agora-project/releases) but its notes don't mention this issue. Until confirmed, limit accounts and the Mail module.

## Timeline

- 2026-11-13T17:48:02+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-63164
- 2026-11-13T17:50:20+00:00 analyst https://nvd.nist.gov/vuln/detail/CVE-2026-63164 — NVD lists affected through 26.10.0 (IDOR, reloadMailTypeId, missing readRight in CtrlMail.php). No vendor advisory or fix found. Sibling CVEs (63156, 63172, 63174) were fixed in 26.10.0, but this one is listed as 'through 26.10.0', so 26.10.0 itself looks vulnerable. Latest release seen is 26.10.5 (GitHub releases, notes don't mention this fix). Fix is unknown; nothing verified.

## Documents

- [advisory] NVD CVE-2026-63164 https://nvd.nist.gov/vuln/detail/CVE-2026-63164
- [mentions] xech/agora-project releases (latest 26.10.5) https://github.com/xech/agora-project/releases

## From the sources

Omnispace Agora Project through 26.10.0 contains an insecure direct object reference vulnerability that allows authenticated attackers to access another user's private mail by supplying a crafted reloadMailTypeId parameter to Ctrl::getCurObj() without a readRight() ownership check in CtrlMail.php. Attackers can manipulate the mail identifier value, such as reloadMailTypeId=mail-1, to retrieve the title and body of private messages belonging to other users, resulting in unauthorized disclosure of sensitive communications.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_