The Agora Project before version 26.10.0 contains a broken access control in the MobileFileDownload route. An attacker can generate an md5 hash of a file name to obtain a valid download token, bypassing the intended authorization check. From the description, this permits unauthenticated users to retrieve arbitrary files. The impact is unauthorized disclosure of protected data, representing a confidentiality breach.

Vendors: Omnispace. Product: Agora Project. The vulnerability affects all releases prior to 26.10.0. No explicit version list is provided, so any installation of Agora Project with a version less than 26.10.0 is vulnerable.

The CVSS score of 8.7 indicates high severity. The EPSS score is less than 1%, which suggests exploitation probability is presently low, but the lack of a KEV listing does not reduce the risk. The vulnerability relies on computing a reversible hash from a file name, meaning an attacker only needs to guess possible file names or discover them via enumeration. Once the md5 token is known, the attacker can download any file accessible through the route, resulting in data exposure.