Public mode

No access to your tenant or devices. Every item links to its source. What this means

CVE-2026-88817

Privilege escalation via legacy access group creation endpoint

CVSS 4.0 8.7 HIGHCheck source for fixed versionsKEV status unknown

Original advisory

cve-program · CVE-2026-88817

Published

An authenticated, non-guest user of Curiosity Workspace could enroll themselves as an administrator and member of an existing access group without an invitation or approval. It did not grant application-wide administrator privileges, and the vulnerability could not be used to obtain root access to the application or its underlying host.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-88817

Published

Curiosity Workspace

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Curiosity GmbH",
                    "product": "Curiosity Workspace",
                    "versions": [
                        {
                            "status": "affected",
                            "version": "26.8.70362",
                            "versionType": "semver"
                        },
                        {
                            "status": "unaffected",
                            "version": "26.8.70363",
                            "versionType": "semver"
                        }
                    ],
                    "defaultStatus": "affected"
                }

Original source record · Cite this exact observation · Complete original publisher JSON