CVE-2026-63154
CVE-2026-63154 · Omnispace Agora Project < 26.10.0 SQL Identifier Injection via agoraFields[]
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Omnispace Agora Project before 26.10.0 contains a SQL identifier injection vulnerability that allows a space administrator to escalate privileges by supplying caller-controlled agoraFields[] names as unvalidated SQL column identifiers during the user import flow. Attackers can inject privileged column names such as generalAdmin or use backtick-injection techniques to set administrative flags and escalate to general administrator privileges.
CVSS 8.7 · High · EPSS 0.4% · Fix available
- Published
- Updated
Affected products and versions
agora project
- Versions
- ≥ 0, < 26.10.0: Affected (semver)
Update to 26.10.0