CVE-2026-63154 Details
Description
Omnispace Agora Project before 26.10.0 contains a SQL identifier injection vulnerability that allows a space administrator to escalate privileges by supplying caller-controlled agoraFields[] names as unvalidated SQL column identifiers during the user import flow. Attackers can inject privileged column names such as generalAdmin or use backtick-injection techniques to set administrative flags and escalate to general administrator privileges.
A SQL identifier injection vulnerability has been identified in Omnispace Agora Project versions prior to 26.10.0. This vulnerability allows space administrators to escalate privileges by injecting caller-controlled names into the agoraFields[] array. These unvalidated names are treated as SQL column identifiers during the user import process. Attackers can exploit this by inserting privileged column names, such as generalAdmin, or by using backtick-injection techniques to manipulate administrative flags, ultimately gaining general administrator privileges.
Users can upgrade to Omnispace Agora Project version 26.10.0 or later to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 13, 2026CISA-ADP
Assessed Oct 14, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/xech/agora-project/releases/tag/26.10 | [email protected] | Release NotesVendor |
| https://www.agora-project.net/ | [email protected] | Vendor |
| https://www.vulncheck.com/advisories/omnispace-agora-project-sql-identifier-injection-via-agorafields | [email protected] | AdvisoryRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-89 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Omnispace Agora Project | < 26.10.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 14, 2026 | CVE Modified | CISA-ADP |
| Oct 13, 2026 | New CVE Received | [email protected] |