CVE-2026-88817 Details
Description
An authenticated, non-guest user of Curiosity Workspace could enroll themselves as an administrator and member of an existing access group without an invitation or approval. It did not grant application-wide administrator privileges, and the vulnerability could not be used to obtain root access to the application or its underlying host.
A privilege escalation vulnerability has been identified in Curiosity Workspace versions through 26.8.70362. Authenticated, non-guest users could improperly enroll themselves as administrators and members of existing access groups without the need for an invitation or approval. While this vulnerability did not provide application-wide administrative rights or root access to the application or its underlying host, it allowed unauthorized access to group management features.
Users are advised to upgrade to Curiosity Workspace version 26.8.70363 or later. After upgrading, review the administrator and member lists for access groups containing sensitive content and remove any unauthorized accounts.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 16, 2026CISA-ADP
Assessed Sep 16, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://docs.curiosity.ai/security/advisories/cve-2026-88817 | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-269 | Improper Privilege Management | [email protected] |
| CWE-284 | Improper Access Control | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Curiosity GmbH Curiosity Workspace | <= 26.8.70362 (semver) |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 23, 2026 | CVE Translated | [email protected] |
| Sep 16, 2026 | CVE Modified | CISA-ADP |
| Sep 16, 2026 | New CVE Received | [email protected] |