---
id: "CVE-2026-9589"
kind: "vulnerability"
aliases: ["CVE-2026-9589"]
title: "Unblu Spark: missing authorization lets users read and change other accounts' settings"
severity: "critical"
cvss: 9.3
epss: null
exploited: false
status: "open"
category: "vendor"
products: [{"name": "Unblu Spark", "fixed": ["8.37.2"], "affected": ">= 7.0, <= 8.36.1-hotfix.0", "ecosystem": "vendor"}]
ecosystems: []
tags: ["collaboration-server", "self-hosted", "unblu", "unblu-cloud", "unblu-spark", "vendor"]
not_affected_if: ["auth-required", "single-account", "unblu-cloud"]
published_at: "2026-10-20T11:17:35+00:00"
first_seen_at: "2026-10-23T21:57:20+00:00"
updated_at: "2026-10-23T23:22:21+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-9589", "first_seen_at": "2026-10-23T21:57:20+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T23:22:21+00:00"}]
---

# Unblu Spark: missing authorization lets users read and change other accounts' settings

Unblu Spark through 8.36.1-hotfix.0 does not check access to the entity a configuration belongs to. A logged-in user can read and change other users' and accounts' config, and in Unblu Cloud other customers'. Cloud is already fixed. On-prem: upgrade to 8.37.2+.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Unblu Spark affected >= 7.0, <= 8.36.1-hotfix.0 fixed 8.37.2

## How to check

On-premises: check the Collaboration Server version; Unblu Spark 8.36.1-hotfix.0 or earlier (CVE says 7.0 and later) is affected. Multi-account installs are most exposed.

## Fix

Upgrade Unblu Spark to 8.37.2 or later. No workaround for on-premises. Unblu Cloud is already patched, no action needed.

## Timeline

- 2026-10-23T21:57:20+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-9589
- 2026-10-23T23:22:21+00:00 analyst — Vendor bulletin UBL-2026-002 (docs.unblu.com, 2026-10-15): fixed in 8.37.2+, Unblu Cloud already patched, no on-prem workaround. Write path beyond own scope needs non-default config validation settings; fix also rejects undefined or invalid properties regardless. Severity 8.9 on-prem, 9.3 cloud. No exploitation or PoC found. Unclear: 8.37.0/8.37.1 status (bulletin lists only 8.37.2; OffSeq says <8.37.0). Bulletin says affected versions start nowhere, CVE says from 7.0. No social posts searched; none likely.

## Documents

- [advisory] Unblu security bulletin UBL-2026-002 (CVE-2026-9589) https://docs.unblu.com/latest/security-bulletins/
- [describes] CVE Record CVE-2026-9589 https://www.cve.org/CVERecord?id=CVE-2026-9589

## From the sources

Missing authorization in the configuration cascade operations of the Collaboration Server in Unblu inc. Unblu Spark 7.0 through 8.36.1-hotfix.0, on on-premises and cloud deployments, allows an authenticated remote attacker to read and change configuration properties of entities they aren't authorized to access, including other users, other accounts and, in Unblu Cloud, other customers' accounts, via configuration read and write operations that target those entities.



The Collaboration Server doesn't check whether the user reading or changing configuration has access to the entity the configuration belongs to. With certain non-default configuration validation settings, a registered user can additionally write configuration properties they aren't allowed to edit, in any scope.



Exploitation requires an authenticated session but no user interaction.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_