Executive brief
Curiosity Studio is a graph and AI platform used to build and deploy enterprise applications. An authenticated user could bypass access controls to enroll themselves as an administrator of existing access groups without proper authorization, gaining visibility and administrative control over sensitive content stored within those groups.
Technical details
This is a privilege escalation vulnerability (CWE-269: Improper Privilege Management, CWE-284: Improper Access Control) in the legacy access group creation endpoint. An authenticated, non-guest user can exploit this to self-enroll as an administrator and member of an existing access group without invitation or approval. The vulnerability requires an authenticated user on a network-accessible instance with no additional prerequisites. Successful exploitation grants administrative control over the targeted group, allowing the attacker to modify membership, roles, group details, or delete the group. The fix is available in version 26.8.70363 and later; no configuration change or data migration is needed upon upgrade.
Affected products
- Curiosity GmbH Curiosity Studio 26.8.70362 and earlier
Timeline
- 2026-09-10: disclosed
- 2026-09-16: patched: Fixed in 26.8.70363 and later