CVE-2026-63168: Omnispace Agora Project < 26.10.0 Stored XSS via Nested POST Array Bypass
Omnispace Agora Project before 26.10.0 contains a stored cross-site scripting vulnerability that allows authenticated attackers to persist unneutralized markup by submitting malicious values as two-dimensional POST arrays through the LDAP/person import flow, bypassing the paramsFilter() request parameter filter which failed to recurse into nested arrays. Attackers can inject arbitrary script code into a user profile that is later rendered to other users, resulting in execution of malicious scripts in victims' browsers.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue and what interaction is required?
An attacker needs an authenticated account and must submit malicious values as two-dimensional POST arrays through the LDAP/person import flow. A victim must later view the affected user profile for the injected script to execute in that victim's browser.
Are installations using the default request filtering protected?
No. The vulnerable paramsFilter() request parameter filter did not recurse into nested arrays, allowing two-dimensional POST array values to bypass filtering in the LDAP/person import flow.
Which versions are affected and what is the available fix?
Omnispace Agora Project versions before 26.10.0 are affected. Upgrade to version 26.10.0 or later.
How can I determine whether malicious content may already be stored?
Review user profiles created or modified through the LDAP/person import flow for unexpected markup or script content, particularly in fields populated from nested POST array input. Stored payloads execute when those profiles are rendered to other users.