CVE-2026-88817 — Privilege escalation via legacy access group creation endpoint

CVE-2026-88817

Privilege escalation via legacy access group creation endpoint PUBLISHED

Description (CNA)

An authenticated, non-guest user of Curiosity Workspace could enroll themselves as an administrator and member of an existing access group without an invitation or approval. It did not grant application-wide administrator privileges, and the vulnerability could not be used to obtain root access to the application or its underlying host.

Affected (CNA)

Vendor / product	Versions
Curiosity GmbH / Curiosity Workspace	affected 26.8.70362; unaffected 26.8.70363

CWE

CWE-269, CWE-284

References

https://docs.curiosity.ai/security/advisories/cve-2026-88817

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.