{"id":"CVE-2026-63163","aliases":[],"url":"https://o3.security/vulnerability/CVE-2026-63163","summary":"Omnispace Agora Project < 26.10.0 Broken Access Control via MobileFileDownload","details":"Omnispace Agora Project before 26.10.0 contains a broken access control vulnerability in the MobileFileDownload route that allows unauthenticated attackers to download arbitrary files by computing an md5(filename) token instead of passing a proper authorization check. Attackers can guess or determine file names to generate the corresponding md5 token and retrieve protected files without authorization, leading to unauthorized information disclosure.","published":"2026-10-13T19:53:16.030Z","modified":"2026-10-15T02:47:35.214936036Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[],"fix":null,"references":[{"type":"WEB","url":"https://www.agora-project.net/"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/63xxx/CVE-2026-63163.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63163"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/omnispace-agora-project-broken-access-control-via-mobilefiledownload"},{"type":"FIX","url":"https://github.com/xech/agora-project/releases/tag/26.10"},{"type":"PACKAGE","url":"https://github.com/xech/agora-project"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-15T02:47:35.214936036Z"}}