Auth bypass in Unblu Spark 7.0-8.36.1: unauthorized config read/write
CVE-2026-9589 Published on October 20, 2026

Unblu Spark Authorization Bypass in Configuration Cascade Operations
Missing authorization in the configuration cascade operations of the Collaboration Server in Unblu inc. Unblu Spark 7.0 through 8.36.1-hotfix.0, on on-premises and cloud deployments, allows an authenticated remote attacker to read and change configuration properties of entities they aren't authorized to access, including other users, other accounts and, in Unblu Cloud, other customers' accounts, via configuration read and write operations that target those entities. The Collaboration Server doesn't check whether the user reading or changing configuration has access to the entity the configuration belongs to. With certain non-default configuration validation settings, a registered user can additionally write configuration properties they aren't allowed to edit, in any scope. Exploitation requires an authenticated session but no user interaction.

Vendor Advisory NVD

Vulnerability Analysis

CVE-2026-9589 can be exploited with network access, and requires small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity and availability.

Attack Vector:
NETWORK
Attack Complexity:
LOW
Privileges Required:
LOW
User Interaction:
NONE

Weakness Types

What is an AuthZ Vulnerability?

The software does not perform an authorization check when an actor attempts to access a resource or perform an action.

CVE-2026-9589 has been classified to as an AuthZ vulnerability or weakness.

What is an Insecure Direct Object Reference / IDOR Vulnerability?

The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

CVE-2026-9589 has been classified to as an Insecure Direct Object Reference / IDOR vulnerability or weakness.


Affected Versions

Unblu inc. Unblu Spark: