Unblu Spark up to 8.36.x Configuration Cascade improper authorization

Summaryinfo

A vulnerability identified as critical has been detected in Unblu Spark up to 8.36.x. This issue affects some unknown processing of the component Configuration Cascade. This manipulation causes improper authorization. This vulnerability is tracked as CVE-2026-9589. The attack is possible to be carried out remotely. No exploit exists. You should upgrade the affected component.

Detailsinfo

A vulnerability classified as critical was found in Unblu Spark up to 8.36.x. Affected by this vulnerability is some unknown functionality of the component Configuration Cascade. The manipulation with an unknown input leads to a improper authorization vulnerability. The CWE definition for the vulnerability is CWE-285. The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

Missing authorization in the configuration cascade operations of the Collaboration Server in Unblu inc. Unblu Spark 7.0 through 8.36.1-hotfix.0, on on-premises and cloud deployments, allows an authenticated remote attacker to read and change configuration properties of entities they aren't authorized to access, including other users, other accounts and, in Unblu Cloud, other customers' accounts, via configuration read and write operations that target those entities. The Collaboration Server doesn't check whether the user reading or changing configuration has access to the entity the configuration belongs to. With certain non-default configuration validation settings, a registered user can additionally write configuration properties they aren't allowed to edit, in any scope. Exploitation requires an authenticated session but no user interaction.

It is possible to read the advisory at docs.unblu.com. This vulnerability is known as CVE-2026-9589 since 05/26/2026. The exploitation appears to be easy. The attack can be launched remotely. The technical details are unknown and an exploit is not publicly available. The attack technique deployed by this issue is T1548.002 according to MITRE ATT&CK.

Upgrading to version 8.37.0 eliminates this vulnerability.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Vendor

• Unblu

Name

• Spark

Version

• 8.0
• 8.1
• 8.2
• 8.3
• 8.4
• 8.5
• 8.6
• 8.7
• 8.8
• 8.9
• 8.10
• 8.11
• 8.12
• 8.13
• 8.14
• 8.15
• 8.16
• 8.17
• 8.18
• 8.19
• 8.20
• 8.21
• 8.22
• 8.23
• 8.24
• 8.25
• 8.26
• 8.27
• 8.28
• 8.29
• 8.30
• 8.31
• 8.32
• 8.33
• 8.34
• 8.35
• 8.36

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion