{"id":"CVE-2026-9589","kind":"vulnerability","aliases":["CVE-2026-9589"],"related":[],"title":"Unblu Spark: missing authorization lets users read and change other accounts' settings","description":"Missing authorization in the configuration cascade operations of the Collaboration Server in Unblu inc. Unblu Spark 7.0 through 8.36.1-hotfix.0, on on-premises and cloud deployments, allows an authenticated remote attacker to read and change configuration properties of entities they aren't authorized to access, including other users, other accounts and, in Unblu Cloud, other customers' accounts, via configuration read and write operations that target those entities.\n\n\n\nThe Collaboration Server doesn't check whether the user reading or changing configuration has access to the entity the configuration belongs to. With certain non-default configuration validation settings, a registered user can additionally write configuration properties they aren't allowed to edit, in any scope.\n\n\n\nExploitation requires an authenticated session but no user interaction.","summary":"Unblu Spark through 8.36.1-hotfix.0 does not check access to the entity a configuration belongs to. A logged-in user can read and change other users' and accounts' config, and in Unblu Cloud other customers'. Cloud is already fixed. On-prem: upgrade to 8.37.2+.","severity":"critical","cvss":9.3,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Unblu Spark","fixed":["8.37.2"],"affected":">= 7.0, <= 8.36.1-hotfix.0","ecosystem":"vendor"}],"ecosystems":[],"tags":["collaboration-server","self-hosted","unblu","unblu-cloud","unblu-spark","vendor"],"not_affected_if":["auth-required","single-account","unblu-cloud"],"how_to_check":"On-premises: check the Collaboration Server version; Unblu Spark 8.36.1-hotfix.0 or earlier (CVE says 7.0 and later) is affected. Multi-account installs are most exposed.","fix":"Upgrade Unblu Spark to 8.37.2 or later. No workaround for on-premises. Unblu Cloud is already patched, no action needed.","status":"open","published_at":"2026-10-20T11:17:35+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","triaged_at":"2026-10-23T22:39:36+00:00","updated_at":"2026-10-23T23:22:21+00:00","category":"vendor","confidence":0.85,"triage":{"at":"2026-10-23T22:39:36Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Unblu Spark: missing authorization lets users read and change other accounts' settings","impact":"high","summary":"Unblu Spark 7.0 through 8.36.1-hotfix.0 does not check whether a logged-in user may access the entity a configuration belongs to. An authenticated attacker can read and change configuration of other users, accounts and, in Unblu Cloud, other customers.","category":"vendor","who_cares":["unblu","unblu-spark","self-hosted","unblu-cloud"],"confidence":0.8,"needs_auth":"yes","worst_case":"Attacker reads and alters other customers' configuration; cross-tenant data exposure.","analyst_note":"Find the vendor advisory and the patched release after 8.36.1-hotfix.0; confirm whether Unblu Cloud is already patched and whether the write path depends on non-default validation settings.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["auth-required"],"user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"critical"},"cost_usd":0.0005,"input_tokens":3082,"output_tokens":384,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Find the vendor advisory and the patched release after 8.36.1-hotfix.0; confirm whether Unblu Cloud is already patched and whether the write path depends on non-default validation settings.","search":"'-2026':14A,17A '-9589':15A,18A '7.0':97C '8.36.1':38B,99C '8.37.2':80B 'access':43B,126C,163C 'account':11A,63B,131C,138C 'addit':183C 'allow':108C,190C 'alreadi':73B 'aren':122C,188C 'attack':112C 'authent':110C,199C 'author':4A,82C,124C 'belong':49B,169C 'cascad':86C 'certain':172C 'chang':9A,59B,116C,160C 'check':42B,154C 'cloud':30B,68B,71B,106C,135C 'collabor':22B,90C,150C 'collaboration-serv':21B 'config':64B 'configur':48B,85C,117C,140C,161C,168C,176C,185C 'custom':70B,137C 'cve':13A,16A 'default':175C 'deploy':107C 'doesn':152C 'edit':192C 'entiti':46B,120C,148C,166C 'exploit':196C 'fix':74B 'host':26B 'hotfix.0':39B,100C 'inc':94C 'includ':127C 'interact':204C 'let':5A 'log':53B 'logged-in':52B 'miss':3A,81C 'non':174C 'non-default':173C 'on-prem':75B 'on-premis':102C 'oper':87C,144C 'prem':77B 'premis':104C 'properti':118C,186C 'read':7A,57B,114C,141C,158C 'regist':180C 'remot':111C 'requir':197C 'scope':195C 'self':25B 'self-host':24B 'server':23B,91C,151C 'session':200C 'set':12A,178C 'spark':2A,20A,33B,36B,96C 'target':146C 'unblu':1A,19A,27B,29B,32B,35B,67B,93C,95C,134C 'unblu-cloud':28B 'unblu-spark':31B 'upgrad':78B 'user':6A,55B,61B,129C,157C,181C,203C 'valid':177C 'vendor':34B 'via':139C 'whether':155C 'write':143C,184C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T11:17:35+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"vulnerability@ncsc.ch","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-9589","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-9589","severity":null,"published_at":"2026-10-20T11:17:35+00:00","modified_at":"2026-10-20T19:28:52+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","fetched_at":"2026-10-23T22:28:58+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-9589:425","url":null,"severity":null,"published_at":"2026-10-23T23:22:21+00:00","modified_at":"2026-10-23T23:22:21+00:00","first_seen_at":"2026-10-23T23:22:21+00:00","fetched_at":"2026-10-23T23:22:21+00:00","note":"Vendor bulletin UBL-2026-002 (docs.unblu.com, 2026-10-15): fixed in 8.37.2+, Unblu Cloud already patched, no on-prem workaround. Write path beyond own scope needs non-default config validation settings; fix also rejects undefined or invalid properties regardless. Severity 8.9 on-prem, 9.3 cloud. No exploitation or PoC found. Unclear: 8.37.0/8.37.1 status (bulletin lists only 8.37.2; OffSeq says <8.37.0). Bulletin says affected versions start nowhere, CVE says from 7.0. No social posts searched; none likely."}],"documents":[{"id":1914,"url":"https://docs.unblu.com/latest/security-bulletins/","title":"Unblu security bulletin UBL-2026-002 (CVE-2026-9589)","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1916,"url":"https://www.cve.org/CVERecord?id=CVE-2026-9589","title":"CVE Record CVE-2026-9589","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}