Summary
Omnispace Agora contains a broken access control vulnerability in setAffectations() that allows an authenticated attacker to create access records for a caller-selected target space without proving authority over it. Under tenant-isolated deployments, this may enable unauthorized access to restricted spaces and weaken separation between tenants.
Omnispace Agora contains a broken access control vulnerability in setAffectations() that allows an authenticated attacker to create access records for a caller-selected target space without proving authority over it. Under tenant-isolated deployments, this may enable unauthorized access to restricted spaces and weaken separation between tenants.
Affected context
The issue occurs in Agora deployments that expose the setAffectations() operation and rely on application-level authorization to protect space membership or access records. Risk is present when the operation accepts a target space identifier from the caller but does not verify that the caller has permission to administer that space.
The issue occurs in Agora deployments that expose the setAffectations() operation and rely on application-level authorization to protect space membership or access records. Risk is present when the operation accepts a target space identifier from the caller but does not verify that the caller has permission to administer that space.
Exploit preconditions
- Attack surface: The application endpoint or service operation that invokes
setAffectations() - Required access: An authenticated account able to reach the affected functionality
- Trigger point: Creation or modification of access-affectation records for a caller-supplied target space
- Why exploitation is possible: Authorization is not adequately bound to the selected target space, allowing a caller to act beyond its permitted tenant or space scope
- Attack surface: The application endpoint or service operation that invokes
setAffectations() - Required access: An authenticated account able to reach the affected functionality
- Trigger point: Creation or modification of access-affectation records for a caller-supplied target space
- Why exploitation is possible: Authorization is not adequately bound to the selected target space, allowing a caller to act beyond its permitted tenant or space scope
Why this happens
The underlying flaw is an object-level authorization failure. The application appears to authenticate the caller but does not consistently verify that the caller is authorized to modify the specific space identified in the request. This maps to CWE-639, Authorization Bypass Through User-Controlled Key, because a user-controlled object or resource identifier is accepted without enforcing access rights for that object.
The underlying flaw is an object-level authorization failure. The application appears to authenticate the caller but does not consistently verify that the caller is authorized to modify the specific space identified in the request. This maps to CWE-639, Authorization Bypass Through User-Controlled Key, because a user-controlled object or resource identifier is accepted without enforcing access rights for that object.
Potential impact
- An attacker may create unauthorized access-affectation records.
- Restricted spaces could become accessible to accounts outside the intended tenant or scope.
- Tenant isolation could be weakened or bypassed.
- Access-control data could be altered, causing unauthorized disclosure or privilege expansion.
- An attacker may create unauthorized access-affectation records.
- Restricted spaces could become accessible to accounts outside the intended tenant or scope.
- Tenant isolation could be weakened or bypassed.
- Access-control data could be altered, causing unauthorized disclosure or privilege expansion.
General mitigation guidance
Mitigation generally focuses on enforcing object-level authorization at the operation that changes access records. Authorization decisions should be derived from trusted server-side identity and resource relationships rather than from caller-supplied scope claims. Secure-by-default designs can deny cross-space changes unless an explicit, independently verified relationship grants them. Resource identifiers should be treated as untrusted input, access checks should occur before any state change, and service accounts should operate with only the privileges required for their tenant or administrative scope. Consistent authorization middleware and centralized policy evaluation can reduce gaps between endpoints.
Mitigation generally focuses on enforcing object-level authorization at the operation that changes access records. Authorization decisions should be derived from trusted server-side identity and resource relationships rather than from caller-supplied scope claims. Secure-by-default designs can deny cross-space changes unless an explicit, independently verified relationship grants them. Resource identifiers should be treated as untrusted input, access checks should occur before any state change, and service accounts should operate with only the privileges required for their tenant or administrative scope. Consistent authorization middleware and centralized policy evaluation can reduce gaps between endpoints.
How teams detect issues like this
Detection approaches include static analysis and code review for handlers that accept resource identifiers and update authorization or membership records without a corresponding ownership or scope check. Reviewers can look for direct database writes based on user-controlled space IDs, authorization checks performed only on the caller rather than the target resource, and missing negative tests for cross-tenant access. Runtime monitoring can flag access-affectation changes involving unrelated tenants or spaces. Automated security review tools and policy-as-code checks may help enforce object-level authorization requirements.
Detection approaches include static analysis and code review for handlers that accept resource identifiers and update authorization or membership records without a corresponding ownership or scope check. Reviewers can look for direct database writes based on user-controlled space IDs, authorization checks performed only on the caller rather than the target resource, and missing negative tests for cross-tenant access. Runtime monitoring can flag access-affectation changes involving unrelated tenants or spaces. Automated security review tools and policy-as-code checks may help enforce object-level authorization requirements.
Sources
| Source | Link |
|---|---|
| github. | github.com/ |
| agora-project. | agora-project.net/ |
| vulncheck. | vulncheck.com/ |
