The vulnerability is a broken access control flaw that allows a space administrator to add users to spaces outside their authorized scope. The flaw stems from an omitted readRight() check during the import flow’s JOIN INSERT, enabling the spaceAffectList operation to assign users to any space the attacker can reach. This is a classic delegation oversight (CWE‑862) that can expose data and functionality belonging to other tenants, compromising confidentiality, integrity, and availability across tenant boundaries.

Omnispace Agora Project versions prior to 26.10.0 are vulnerable. The affected product is the Agora Project from Omnispace, and any deployment using releases older than 26.10.0 is at risk.

The CVSS score of 8.6 indicates a high severity vulnerable situation. The EPSS score of less than 1% suggests a low probability of exploitation, but the flaw can be leveraged by anyone who possesses space‑level administrative credentials or can compromise such credentials. Based on the description, it is inferred that the attack vector is internal or insider‑based, requiring authenticated access at the space level but not further privilege escalation. The vulnerability is not listed in CISA KEV, meaning that no publicly known exploitation has been documented yet, yet the inherent weakness remains significant for tenants that rely on strict isolation.