CVE-2026-88817
UnratedPublished 2026-09-16 ยท last changed 2026-09-18
The fix
We hold no Microsoft remediation data for CVE-2026-88817, which normally means it is not a Windows CVE. For non-Microsoft software the fix is the vendor's own updated release, and the affected versions are listed below.
What it is
An authenticated, non-guest user of Curiosity Workspace could enroll themselves as an administrator and member of an existing access group without an invitation or approval. It did not grant application-wide administrator privileges, and the vulnerability could not be used to obtain root access to the application or its underlying host.