Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.3

Unblu Spark lets logged-in users modify others' settings

CVE-2026-9589 · published 2 days ago
Summary

In Unblu Spark versions 7.0 up to 8.36.1‑hotfix.0, the Collaboration Server does not verify a user’s rights when reading or changing configuration data. This lets anyone with a valid account view and change settings belonging to other users, accounts, or even other customers in the cloud. Apply the vendor’s security update or restrict configuration changes until the patch is installed.

What to do
  • Update unblu inc. unblu spark to version 8.37.0 or later.
Affected software
VendorProductAffected versions
unblu inc. unblu spark < 8.37.0
Original advisory text
Unblu Spark Authorization Bypass in Configuration Cascade Operations
Missing authorization in the configuration cascade operations of the Collaboration Server in Unblu inc. Unblu Spark 7.0 through 8.36.1-hotfix.0, on on-premises and cloud deployments, allows an authenticated remote attacker to read and change configuration properties of entities they aren't authorized to access, including other users, other accounts and, in Unblu Cloud, other customers' accounts, via configuration read and write operations that target those entities.



The Collaboration Server doesn't check whether the user reading or changing configuration has access to the entity the configuration belongs to. With certain non-default configuration validation settings, a registered user can additionally write configuration properties they aren't allowed to edit, in any scope.



Exploitation requires an authenticated session but no user interaction.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
9.3 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-639Authorization Bypass Through User-Controlled Key
CWE-862Missing Authorization
Timeline
Published20 Oct 2026
Updated22 Oct 2026
First seen20 Oct 2026
Sources
CVE-2026-9589 · NVD
CVE-2026-9589 · MITRE
Track software like this
Free during beta