CVE-2026-63172 in Agora Project
Riassunto
di MITRE • 14/10/2026
Omnispace Agora Project before 26.10.0 contains a broken access control vulnerability that allows a regular, non-administrative member to create user accounts by invoking the user-edit action without a function-level authorization check. Attackers can exploit the missing editRight() enforcement in actionVueEditUser to create unauthorized user accounts, leading to privilege escalation.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.