CVE-2026-63154: Omnispace Agora Project < 26.10.0 SQL Identifier Injection via agoraFields[]
Omnispace Agora Project before 26.10.0 contains a SQL identifier injection vulnerability that allows a space administrator to escalate privileges by supplying caller-controlled agoraFields[] names as unvalidated SQL column identifiers during the user import flow. Attackers can inject privileged column names such as generalAdmin or use backtick-injection techniques to set administrative flags and escalate to general administrator privileges.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs space administrator privileges. The vulnerable path is the user import flow, where the attacker can supply crafted agoraFields[] field names.
What is the impact of successful exploitation?
A space administrator can set privileged administrative flags, including generalAdmin, and escalate to general administrator privileges. The vulnerability can affect confidentiality, integrity, and availability.
Which versions need remediation?
Omnispace Agora Project versions before 26.10.0 are affected. Upgrade to version 26.10.0 or a later release.