The vulnerability is a broken function‑level authorization flaw that allows a regular, non‑administrative member to invoke the user‑edit action without the required editRight() check. As a result, an attacker can create new user accounts with authorization levels higher than intended, effectively escalating privileges within the application. The flaw is documented as a missing authorization check (CWE‑862).

Affected vendors include Omnispace, with the vulnerability found in the Agora Project for all releases prior to version 26.10.0. Any installation of the Agora Project before this release is potentially susceptible.

The CVSS score of 7.1 indicates a medium‑to‑high severity vulnerability, and the EPSS score of < 1% suggests a low probability of current exploitation. The flaw is not listed in CISA’s KEV catalog. The likely attack vector is through the web application by an authenticated regular user. Although exploitation requires an authenticated session, the loss of proper authorization can lead to privilege escalation if an attacker gains the ability to create privileged accounts.