{"metadata": {"vulnerability": "CVE-2026-63164", "count": 11, "kinds": {"milestone": 3, "sighting": 1, "kev": 0, "other": 7}, "linked_omitted": 0}, "data": [{"timestamp": "2026-07-15T21:18:20.186Z", "date_only": false, "value": "2026-07-15T21:18:20.186Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-63164", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-11-13T00:00:00Z", "date_only": false, "value": "2026-11-13T00:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / VulnCheck", "record": "CVE-2026-63164", "field": "containers.cna.datePublic", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-11-13T17:02:42.943Z", "date_only": false, "value": "2026-11-13T17:02:42.943Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-63164", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-11-13T17:10:51.466Z", "date_only": false, "value": "2026-11-13T17:10:51.466642Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117610240475856799", "record": "cve-2026-63164", "field": "creation_timestamp", "uuid": "5fecc01b-8144-43c9-83bc-7e66bfbdddcb", "content": "CVE-2026-63164 Omnispace Agora Project 26.10.0 IDOR via reloadMailTypeId Parameter Omnispace Agora Project through 26.10.0 contains an insecure direct object reference vulnerability that allows authenticated attackers to access another user's private mail by supplying a crafted reloadMailTypeId parameter to Ctrl::getCurObj() without a readRight() ownership check in CtrlMail.php. Attackers can manipulate the mail identifier value, such as reloadMailTypeId=mail-1, to retrieve the title and body of private messages belonging to other users, resulting in unauthorized disclosure of sensitive communications.\nhttps://www.cve.org/CVERecord?id=CVE-2026-63164https://www.akailabs.fr/blog/multiple-vulnerabilities-in-agora-project-26-5-2#cve-2026-63164-idor-in-reloadmailtypeid-allows-reading-and-exfiltration-of-other#Omnispace #AgoraProject#CVE_2026_63164#bot", "url": "https://infosec.exchange/users/cve/statuses/117610240475856799"}, {"timestamp": "2026-11-13T17:17:33Z", "date_only": false, "value": "2026-11-13T17:17:33Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-73CC-WJFH-7VGP", "record": "GHSA-73CC-WJFH-7VGP", "field": "database_specific.nvd_published_at", "linked_record": true}, {"timestamp": "2026-11-13T17:21:47.515Z", "date_only": false, "value": "2026-11-13T17:21:47.515Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / VulnCheck", "record": "CVE-2026-63164", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-11-13T18:32:32Z", "date_only": false, "value": "2026-11-13T18:32:32Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-73CC-WJFH-7VGP", "record": "GHSA-73CC-WJFH-7VGP", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-13T18:32:32Z", "date_only": false, "value": "2026-11-13T18:32:32Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-73CC-WJFH-7VGP", "record": "GHSA-73CC-WJFH-7VGP", "field": "modified", "linked_record": true}, {"timestamp": "2026-11-13T21:12:32.921Z", "date_only": false, "value": "2026-11-13T21:12:32.921328Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-63164", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-11-13T21:12:40.343Z", "date_only": false, "value": "2026-11-13T21:12:40.343Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-63164", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-11-13T21:12:40.343Z", "date_only": false, "value": "2026-11-13T21:12:40.343Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-63164", "field": "containers.adp.0.providerMetadata.dateUpdated"}], "metrics": {"as_of": "2026-11-13T23:33:29.375Z", "anchors": {"origin": {"timestamp": "2026-11-13T00:00:00Z", "date_only": false, "value": "2026-11-13T00:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / VulnCheck", "record": "CVE-2026-63164", "field": "containers.cna.datePublic", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-11-13T00:00:00Z", "date_only": false, "value": "2026-11-13T00:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / VulnCheck", "record": "CVE-2026-63164", "field": "containers.cna.datePublic", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "exploit_publication": null, "exploitation": null, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": false, "missing": ["end"]}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 84809.375951, "hours": 23.558159986388887, "days": 0.9815899994328703, "min_seconds": 0.0, "max_seconds": 84809.375951, "approximate": true, "ongoing": true, "order_known": false, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-11-13T00:00:00Z", "date_only": false, "value": "2026-11-13T00:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / VulnCheck", "record": "CVE-2026-63164", "field": "containers.cna.datePublic", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-11-13T23:33:29.375Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": false, "missing": ["start"]}}}