Live › vulnerability › CVE-2026-9589
Go to dashboardUnblu Spark through 8.36.1-hotfix.0 does not check access to the entity a configuration belongs to. A logged-in user can read and change other users' and accounts' config, and in Unblu Cloud other customers'. Cloud is already fixed. On-prem: upgrade to 8.37.2+.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| Unblu Spark | vendor | >= 7.0, <= 8.36.1-hotfix.0 | 8.37.2 |
8.36.1-hotfix.0 or earlier (CVE says 7.0 and later) is affected8.37.2 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Missing authorization in the configuration cascade operations of the Collaboration Server in Unblu inc. Unblu Spark 7.0 through 8.36.1-hotfix.0, on on-premises and cloud deployments, allows an authenticated remote attacker to read and change configuration properties of entities they aren't authorized to access, including other users, other accounts and, in Unblu Cloud, other customers' accounts, via configuration read and write operations that target those entities.
The Collaboration Server doesn't check whether the user reading or changing configuration has access to the entity the configuration belongs to. With certain non-default configuration validation settings, a registered user can additionally write configuration properties they aren't allowed to edit, in any scope.
Exploitation requires an authenticated session but no user interaction.
This page as .md · .json · in your agent: get_signal("CVE-2026-9589")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.