---
id: "CVE-2026-63173"
page: "https://infrastack.ai/live/CVE-2026-63173"
kind: "vulnerability"
aliases: ["CVE-2026-63173"]
title: "Agora Project: former space members keep read access to their objects"
severity: "medium"
cvss: 5.4
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["agora-project", "omnispace", "package", "self-hosted"]
not_affected_if: ["no-removed-members"]
published_at: "2026-11-13T18:17:48+00:00"
first_seen_at: "2026-11-13T18:49:31+00:00"
updated_at: "2026-11-13T18:51:47+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-63173", "first_seen_at": "2026-11-13T18:49:31+00:00"}]
exploit_sources: []
---

# Agora Project: former space members keep read access to their objects

Link for people: https://infrastack.ai/live/CVE-2026-63173 (this .md is for agents)

Omnispace Agora Project through 26.10.0 grants full read rights based only on who authored an object, without checking whether that author is still in the space. A person removed from a space can keep reading objects they wrote there.

_Summary, check and fix written by a model from the sources; labelled as such._

## Timeline

- 2026-11-13T18:49:31+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-63173

## Documents

- [advisory] VulnCheck: Agora Project <= 26.10.0 isAutor() (sibling CVE-2026-63173, same batch) https://www.vulncheck.com/advisories/omnispace-agora-project-broken-access-control-via-isautor

## From the sources

Omnispace Agora Project through 26.10.0 contains a broken access control vulnerability in which the isAutor() function in MdlObject.php grants accessRight=3 based solely on object authorship without verifying the user still belongs to the object's space. Attackers who were previously members and authored objects can retain unauthorized read access to space objects even after being removed from the space, leading to persistent information disclosure.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_