CVE-2026-9589 Details
Description
Missing authorization in the configuration cascade operations of the Collaboration Server in Unblu inc. Unblu Spark 7.0 through 8.36.1-hotfix.0, on on-premises and cloud deployments, allows an authenticated remote attacker to read and change configuration properties of entities they aren't authorized to access, including other users, other accounts and, in Unblu Cloud, other customers' accounts, via configuration read and write operations that target those entities. The Collaboration Server doesn't check whether the user reading or changing configuration has access to the entity the configuration belongs to. With certain non-default configuration validation settings, a registered user can additionally write configuration properties they aren't allowed to edit, in any scope. Exploitation requires an authenticated session but no user interaction.
A vulnerability exists in Unblu Spark versions 7.0 through 8.36.1-hotfix.0, in both on-premises and cloud deployments. The issue arises from missing authorization checks in the Collaboration Server's configuration cascade operations. This flaw allows an authenticated remote attacker to read and modify configuration properties of unauthorized entities, including other users, accounts, and, in Unblu Cloud, accounts of different customers. The vulnerability stems from the server's failure to verify whether a user has access to the entity associated with the configuration being read or changed. Additionally, under certain non-default configuration validation settings, a registered user could overwrite configuration properties they are not permitted to edit, across any scope.
Unblu Cloud customers do not need to take any action, as the fix has already been deployed. On-premises users should upgrade to Unblu Spark version 8.37.2 or later.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 20, 2026CISA-ADP
Assessed Oct 20, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://docs.unblu.com/latest/security-bulletins/#UBL-2026-002 | [email protected] | AdvisoryBundleRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-639 | Authorization Bypass Through User-Controlled Key | [email protected] |
| CWE-862 | Missing Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Unblu Spark | >= 8.0, <= 8.36.1-hotfix.0 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 20, 2026 | CVE Modified | CISA-ADP |
| Oct 20, 2026 | New CVE Received | [email protected] |