The vulnerability is a broken access control flaw in the setAffectations() function of Omnispace Agora Project that allows an authenticated user to create or modify access‑right records for any target space without verifying the user’s ownership or permission on that space. This activity permits attackers to extend their access to spaces outside their authorized tenant, thereby compromising the confidentiality and isolation guarantees of the platform. Since the flaw is based on manipulation of authorization data, it maps to CWE-639.

Omnispace Agora Project versions prior to 26.10.0 are affected. Users operating these earlier releases are at risk when performing setAffectations() operations on spaces that they do not own.

The CVSS score of 8.6 indicates high severity. The EPSS score of < 1% suggests a very low probability of exploitation in the wild, and the vulnerability is not listed in CISA KEV. However, attackers who are authenticated to the system can exploit the flaw by calling setAffectations() to add privileges for any target space, effectively bypassing tenant isolation. The likely attack vector is through the application’s authenticated API or user interface, and the vulnerability requires no special privileges beyond account authentication.