CVE-2026-9589

{
  "etk_id": "ETK-2026-2163",
  "cve_id": "CVE-2026-9589",
  "display_id": "CVE-2026-9589",
  "ghsa_id": "GHSA-m9mc-chm4-qcpm",
  "euvd_id": "EUVD-2026-104932",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Authorization bypass in Unblu Spark configuration operations",
  "summary": "Unblu Spark versions before 8.37.0 do not properly enforce authorization for certain Collaboration Server configuration operations. An authenticated remote user may read or modify configuration belonging to other users, accounts, or, in cloud deployments, other customers; no user interaction is required.",
  "mitigation": "Upgrade Unblu Spark to version 8.37.0 or later. Until upgraded, restrict access to authenticated Collaboration Server users to only necessary accounts and sessions.",
  "vendor": "Unblu inc.",
  "product": "Unblu Spark",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 7.0, < 8.37.0"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "8.37.0"
      ],
      "package_name": "Unblu Spark",
      "purl": null
    }
  ],
  "cwes": [
    862
  ],
  "cvss_score": 9.3,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:H/SA:H",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 15.63329535,
  "t0_at": "2026-10-20T11:01:14.409000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-10-20T11:01:14.409000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-20T11:01:14.409000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-9589"
    }
  }
}