{"id":"CVE-2026-63170","kind":"vulnerability","aliases":["CVE-2026-63170"],"related":[],"title":"Omnispace Agora: predictable calendar share tokens let attackers read shared calendars","description":"Omnispace Agora Project through 26.10.0 contains a predictable token generation vulnerability that allows unauthenticated attackers to forge the shared-calendar iCal share token by deriving md5Id() from predictable fields such as object creation time, which is self-disclosed through autorDate and the iCal CREATED field. Attackers can compute the creation minute and forge the md5Id token to access and read a shared calendar's iCal feed without authorization.","summary":"Omnispace Agora Project through 26.10.0 generates shared-calendar iCal share tokens from predictable values such as object creation time. An unauthenticated attacker can compute the token and read a shared calendar's iCal feed without permission.","severity":"medium","cvss":6.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["calendar-sharing","omnispace-agora","other","self-hosted"],"not_affected_if":["no-calendar-sharing"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-13T17:17:34+00:00","first_seen_at":"2026-11-13T17:48:02+00:00","triaged_at":"2026-11-13T17:48:58+00:00","updated_at":"2026-11-13T17:48:58+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-11-13T17:48:58Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Omnispace Agora: predictable calendar share tokens let attackers read shared calendars","impact":"medium","summary":"Omnispace Agora Project through 26.10.0 generates shared-calendar iCal share tokens from predictable values such as object creation time. An unauthenticated attacker can compute the token and read a shared calendar's iCal feed without permission.","audience":"businesses","category":"other","nicknames":[],"who_cares":["omnispace-agora","calendar-sharing","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker reads shared calendar contents without authorization","analyst_note":"Check the Omnispace Agora project page or advisory for the fixed version and whether the share-token feature is enabled by default; NVD alone gives no fix.","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-calendar-sharing"],"who_is_affected":"Teams running Omnispace Agora Project through 26.10.0 that share calendars through iCal links. The sources do not say which deployments or configurations expose the share feature by default. Sites that do not use calendar sharing are likely not affected.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000696,"input_tokens":4599,"output_tokens":472,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-63170':14A,17A '26.10.0':32B,69C 'access':124C 'agora':2A,23B,29B,66C 'allow':77C 'attack':8A,50B,79C,112C 'author':134C 'autord':106C 'calendar':4A,11A,19B,36B,59B,85C,129C 'calendar-shar':18B 'comput':52B,114C 'contain':70C 'creat':110C 'creation':46B,98C,116C 'cve':12A,15A 'deriv':90C 'disclos':104C 'feed':62B,132C 'field':94C,111C 'forg':81C,119C 'generat':33B,74C 'host':27B 'ical':37B,61B,86C,109C,131C 'let':7A 'md5id':91C,121C 'minut':117C 'object':45B,97C 'omnispac':1A,22B,28B,65C 'omnispace-agora':21B 'permiss':64B 'predict':3A,41B,72C,93C 'project':30B,67C 'read':9A,56B,126C 'self':26B,103C 'self-disclos':102C 'self-host':25B 'share':5A,10A,20B,35B,38B,58B,84C,87C,128C 'shared-calendar':34B,83C 'time':47B,99C 'token':6A,39B,54B,73C,88C,122C 'unauthent':49B,78C 'valu':42B 'vulner':75C 'without':63B,133C","nicknames":[],"mitigations":[],"who_affected":"Teams running Omnispace Agora Project through 26.10.0 that share calendars through iCal links. The sources do not say which deployments or configurations expose the share feature by default. Sites that do not use calendar sharing are likely not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["calendarsharing","medium","omnispaceagora","other","selfhosted"],"campaign_type":null,"search_a":"'-2026':13A,16A '-63170':14A,17A 'agora':2A 'attack':8A 'calendar':4A,11A 'cve':12A,15A 'let':7A 'omnispac':1A 'predict':3A 'read':9A 'share':5A,10A 'token':6A","search_b":"'26.10.0':32B 'agora':23B,29B 'attack':50B 'calendar':19B,36B,59B 'calendar-shar':18B 'comput':52B 'creation':46B 'feed':62B 'generat':33B 'host':27B 'ical':37B,61B 'object':45B 'omnispac':22B,28B 'omnispace-agora':21B 'permiss':64B 'predict':41B 'project':30B 'read':56B 'self':26B 'self-host':25B 'share':20B,35B,38B,58B 'shared-calendar':34B 'time':47B 'token':39B,54B 'unauthent':49B 'valu':42B 'without':63B","search_c":"'26.10.0':69C 'access':124C 'agora':66C 'allow':77C 'attack':79C,112C 'author':134C 'autord':106C 'calendar':85C,129C 'comput':114C 'contain':70C 'creat':110C 'creation':98C,116C 'deriv':90C 'disclos':104C 'feed':132C 'field':94C,111C 'forg':81C,119C 'generat':74C 'ical':86C,109C,131C 'md5id':91C,121C 'minut':117C 'object':97C 'omnispac':65C 'predict':72C,93C 'project':67C 'read':126C 'self':103C 'self-disclos':102C 'share':84C,87C,128C 'shared-calendar':83C 'time':99C 'token':73C,88C,122C 'unauthent':78C 'vulner':75C 'without':133C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T17:17:34+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-63170","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63170","severity":null,"published_at":"2026-11-13T17:17:34+00:00","modified_at":"2026-11-13T17:17:34+00:00","first_seen_at":"2026-11-13T17:48:02+00:00","fetched_at":"2026-11-13T17:48:02+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}