Description
Omnispace Agora Project through 26.10.0 contains an insecure direct object reference vulnerability that allows authenticated attackers to access another user's private mail by supplying a crafted reloadMailTypeId parameter to Ctrl::getCurObj() without a readRight() ownership check in CtrlMail.php. Attackers can manipulate the mail identifier value, such as reloadMailTypeId=mail-1, to retrieve the title and body of private messages belonging to other users, resulting in unauthorized disclosure of sensitive communications.
Published: 2026-11-13
Score: 7.1 High
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

No vendor fix or workaround currently provided.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 13 Nov 2026 17:30:00 +0000

Type Values Removed Values Added
References

Fri, 13 Nov 2026 17:15:00 +0000

Type Values Removed Values Added
Description Omnispace Agora Project through 26.10.0 contains an insecure direct object reference vulnerability that allows authenticated attackers to access another user's private mail by supplying a crafted reloadMailTypeId parameter to Ctrl::getCurObj() without a readRight() ownership check in CtrlMail.php. Attackers can manipulate the mail identifier value, such as reloadMailTypeId=mail-1, to retrieve the title and body of private messages belonging to other users, resulting in unauthorized disclosure of sensitive communications.
Title Omnispace Agora Project 26.10.0 IDOR via reloadMailTypeId Parameter
First Time appeared Agora-project
Agora-project agora-project
Weaknesses CWE-639
CPEs cpe:2.3:a:agora-project:agora-project:*:*:*:*:*:*:*:*
Vendors & Products Agora-project
Agora-project agora-project
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'}

cvssV4_0

{'score': 7.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

Agora-project Agora-project
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-11-13T17:21:47.515Z

Reserved: 2026-07-15T21:18:20.186Z

Link: CVE-2026-63164

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-11-13T17:17:33.850

Modified: 2026-11-13T18:17:46.223

Link: CVE-2026-63164

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses
  • CWE-639

    Authorization Bypass Through User-Controlled Key