CVE-2026-63170 · Other
NO FIX YET
Omnispace Agora Project through 26.10.0 generates shared-calendar iCal share tokens from predictable values such as object creation time. An unauthenticated attacker can compute the token and read a shared calendar's iCal feed without permission.
first public Nov 13, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Teams running Omnispace Agora Project through 26.10.0 that share calendars through iCal links. The sources do not say which deployments or configurations expose the share feature by default. Sites that do not use calendar sharing are likely not affected.
Not affected if no-calendar-sharing
Who cares calendar-sharing, omnispace-agora, self-hosted
Unknown from the sources.
No fix yet, per the sources.
Omnispace Agora Project through 26.10.0 contains a predictable token generation vulnerability that allows unauthenticated attackers to forge the shared-calendar iCal share token by deriving md5Id() from predictable fields such as object creation time, which is self-disclosed through autorDate and the iCal CREATED field. Attackers can compute the creation minute and forge the md5Id token to access and read a shared calendar's iCal feed without authorization.
This page as .md · .json · CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.