CVE-2026-88817 — Privilege escalation via legacy access group creation endpoint
An authenticated, non-guest user of Curiosity Workspace could enroll themselves as an administrator and member of an existing access group without an invitation or approval. …
Published: 2026-09-16 · CVSS: 8.7 · CVSS 4.0
An authenticated, non-guest user of Curiosity Workspace could enroll themselves as an administrator and member of an existing access group without an invitation or approval. It did not grant application-wide administrator privileges, and the vulnerability could not be used to obtain root access to the application or its underlying host.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7