Unblu Spark Critical Auth Bypass in Versions Before 8.37.0 Allows Config Tampering

The National Vulnerability Database has published CVE-2026-9589, a critical authorization bypass affecting Unblu Spark. This flaw impacts versions 7.0 through 8.36.1-hotfix.0 and allows authenticated remote attackers to manipulate configuration settings they should not access. The issue arises in the Collaboration Server component of the software.

The vulnerability stems from missing authorization checks during configuration cascade operations. An attacker with a valid session can read and change properties belonging to other users, accounts, or, in cloud environments, other customers. This occurs because the server fails to verify if the user has access rights to the specific entity whose configuration is being targeted.

Technical Details and Scope

The National Vulnerability Database assigns a CVSS score of 9.3 to this critical severity issue. The weakness is categorized under CWE-862 and CWE-639. Exploitation requires an authenticated session but does not require any user interaction beyond that initial login. The flaw exists in both on-premises and cloud deployments of the affected software versions.

With certain non-default configuration validation settings, the risk expands further. A registered user may write configuration properties they are not allowed to edit, in any scope. This means the attacker can alter settings across the system, potentially impacting entities outside their immediate permission set. The lack of authorization checks is the core technical failure.

Affected Versions and Context

Unblu Spark versions before 8.37.0 are affected by this vulnerability. Specifically, versions 7.0 through 8.36.1-hotfix.0 are vulnerable in both deployment models. The flaw allows access to other customers' accounts in Unblu Cloud, raising significant multi-tenancy concerns. This follows a pattern of configuration-related risks in collaborative platforms, as Threat Times reported on 2026-10-19 regarding a similar authorization bypass in Craft CMS.

That suggests that configuration management interfaces require rigorous access controls to prevent lateral movement. The Unblu flaw highlights the danger of missing authorization checks in server-side operations. Organizations using these older versions must assess their exposure immediately.

What should you do?

Administrators should verify their current Unblu Spark version against the affected list. Check for any unauthorized configuration changes in recent logs. Monitor for anomalous activity from authenticated users who may be testing boundaries. Prepare to upgrade to version 8.37.0 or later once the vendor provides an update to address this critical gap.