{"id":"CVE-2026-63173","kind":"vulnerability","aliases":["CVE-2026-63173"],"related":[],"title":"Agora Project: former space members keep read access to their objects","description":"Omnispace Agora Project through 26.10.0 contains a broken access control vulnerability in which the isAutor() function in MdlObject.php grants accessRight=3 based solely on object authorship without verifying the user still belongs to the object's space. Attackers who were previously members and authored objects can retain unauthorized read access to space objects even after being removed from the space, leading to persistent information disclosure.","summary":"Omnispace Agora Project through 26.10.0 grants full read rights based only on who authored an object, without checking whether that author is still in the space. A person removed from a space can keep reading objects they wrote there.","severity":"medium","cvss":5.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["agora-project","omnispace","package","self-hosted"],"not_affected_if":["no-removed-members"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-13T18:17:48+00:00","first_seen_at":"2026-11-13T18:49:31+00:00","triaged_at":"2026-11-13T18:51:47+00:00","updated_at":"2026-11-13T18:51:47+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-13T18:51:47Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Agora Project: former space members keep read access to their objects","impact":"medium","summary":"Omnispace Agora Project through 26.10.0 grants full read rights based only on who authored an object, without checking whether that author is still in the space. A person removed from a space can keep reading objects they wrote there.","audience":"businesses","category":"package","nicknames":[],"who_cares":["agora-project","omnispace","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"former members keep reading space objects they authored","analyst_note":"Find the fixed version and any patch for Agora Project past 26.10.0 in the NVD entry or VulnCheck advisory.","how_to_check":"- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-removed-members"],"who_is_affected":"Teams running Omnispace Agora Project through 26.10.0 where users are removed from spaces that still hold objects they authored. The flaw is in the access check in MdlObject.php, so exposure depends on that code path being reached; the sources do not say which deployments are most exposed.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000683,"input_tokens":4632,"output_tokens":440,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-63173':14A,17A '26.10.0':30B,68C '3':84C 'access':8A,72C,113C 'accessright':83C 'agora':1A,19B,27B,65C 'agora-project':18B 'attack':101C 'author':39B,46B,107C 'authorship':89C 'base':35B,85C 'belong':95C 'broken':71C 'check':43B 'contain':69C 'control':73C 'cve':12A,15A 'disclosur':128C 'even':117C 'former':3A 'full':32B 'function':79C 'grant':31B,82C 'host':25B 'inform':127C 'isautor':78C 'keep':6A,59B 'lead':124C 'mdlobject.php':81C 'member':5A,105C 'object':11A,41B,61B,88C,98C,108C,116C 'omnispac':21B,26B,64C 'packag':22B 'persist':126C 'person':53B 'previous':104C 'project':2A,20B,28B,66C 'read':7A,33B,60B,112C 'remov':54B,120C 'retain':110C 'right':34B 'self':24B 'self-host':23B 'sole':86C 'space':4A,51B,57B,100C,115C,123C 'still':48B,94C 'unauthor':111C 'user':93C 'verifi':91C 'vulner':74C 'whether':44B 'without':42B,90C 'wrote':63B","nicknames":[],"mitigations":[],"who_affected":"Teams running Omnispace Agora Project through 26.10.0 where users are removed from spaces that still hold objects they authored. The flaw is in the access check in MdlObject.php, so exposure depends on that code path being reached; the sources do not say which deployments are most exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["agoraproject","medium","omnispace","package","selfhosted"],"campaign_type":null,"search_a":"'-2026':13A,16A '-63173':14A,17A 'access':8A 'agora':1A 'cve':12A,15A 'former':3A 'keep':6A 'member':5A 'object':11A 'project':2A 'read':7A 'space':4A","search_b":"'26.10.0':30B 'agora':19B,27B 'agora-project':18B 'author':39B,46B 'base':35B 'check':43B 'full':32B 'grant':31B 'host':25B 'keep':59B 'object':41B,61B 'omnispac':21B,26B 'packag':22B 'person':53B 'project':20B,28B 'read':33B,60B 'remov':54B 'right':34B 'self':24B 'self-host':23B 'space':51B,57B 'still':48B 'whether':44B 'without':42B 'wrote':63B","search_c":"'26.10.0':68C '3':84C 'access':72C,113C 'accessright':83C 'agora':65C 'attack':101C 'author':107C 'authorship':89C 'base':85C 'belong':95C 'broken':71C 'contain':69C 'control':73C 'disclosur':128C 'even':117C 'function':79C 'grant':82C 'inform':127C 'isautor':78C 'lead':124C 'mdlobject.php':81C 'member':105C 'object':88C,98C,108C,116C 'omnispac':64C 'persist':126C 'previous':104C 'project':66C 'read':112C 'remov':120C 'retain':110C 'sole':86C 'space':100C,115C,123C 'still':94C 'unauthor':111C 'user':93C 'verifi':91C 'vulner':74C 'without':90C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T18:17:48+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-63173","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63173","severity":null,"published_at":"2026-11-13T18:17:48+00:00","modified_at":"2026-11-13T18:17:48+00:00","first_seen_at":"2026-11-13T18:49:31+00:00","fetched_at":"2026-11-13T18:49:31+00:00","note":null}],"documents":[{"id":148155,"url":"https://www.vulncheck.com/advisories/omnispace-agora-project-broken-access-control-via-isautor","title":"VulnCheck: Agora Project <= 26.10.0 isAutor() (sibling CVE-2026-63173, same batch)","kind":"advisory","source":"analyst","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}