An authenticated, non-guest user of Curiosity Workspace could enroll themselves as an administrator and member of an existing access group without an invitation or approval.
CVSS 4.0HIGH 8.7·Network·Low privileges·No interaction·EPSS 0.00351·Published 2026-09-16·Fixed in 26.8.70363CWE-269