CVE-2026-63172 is a high severity (CVSS 7.1) broken access control flaw in Omnispace Agora Project before 26.10.0. A regular, non-administrative member can create user accounts because the user-edit action has no function-level authorization check, which is a route to privilege escalation. Upgrade to 26.10.
What's affected
The record says Omnispace Agora Project before 26.10.0. The weakness is CWE-862 (missing authorization). The record names the missing editRight() check in actionVueEditUser.
The vector is network based, low complexity, low privileges and no user interaction, with high integrity impact and low confidentiality impact. The consequence is privilege escalation: a member can add accounts that the system should have refused.
Source note. The release page for 26.10 (the latest listed is 26.10.2) describes feature changes and does not mention security fixes, so the fixed version comes from the record, which says before 26.10.0. Upgrade to the current 26.10 release and confirm the change log for your build.
How to check if you're exposed
Check the installed release first. Then list your user accounts and look for any you do not recognise.
grep -n "editRight" /path/to/agora/app/ModUser/*.php 2>/dev/null | head
The user list in the administration area shows creation dates. Compare them against your records of who was onboarded and when, and check accounts created since you installed a release before 26.10.
Whatever the product, a current inventory of what you run is what turns a CVE notice into a quick answer. The Gold page for this CVE tracks how its record changes over time, and the free in-browser dependency scan at gold.safeguard.sh/scan covers the application libraries you ship.
What to do now
- Upgrade to the current 26.10 release.
- Review the user list for accounts created by someone other than an administrator, and disable any you cannot explain.
- Check the access logs for user creation requests from non-administrator accounts.
- Reset passwords for accounts you cannot verify.
- Limit who can register on the system to the people who need to.
Why it matters
Function-level authorization means checking, on every action, whether this caller may perform it. Hiding a button in the interface is not a check. If the server action runs without a test, anyone who can reach it can use it.
Creating an account is a powerful action, because a new account can be given rights or used for persistence. The class is CWE-862. The record does not list the CVE as exploited in the wild.
Quick check
Is hiding the user-create button enough?
No. The check must run on the server for each request. Hiding a control only changes what honest users see.
Sources
Last reviewed: 18 October 2026.
