CVE-2026-63154
8.8HighPublished 13 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
- Impact
- Full C/I/A compromise
- Weakness
- CWE-89
Impact
Authenticated space administrators can escalate privileges to full general administrator across the deployment. They only need access to a low-privileged space admin account and network access to the user import flow.
Root cause
The application fails to validate the user-supplied agoraFields[] parameter, interpolating it directly as an unescaped SQL column identifier during user import.
Affected systems
Omnispace Agora Project versions prior to 26.10.0
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Fix & remediation
Upgrade Omnispace Agora Project to version 26.10.0 or later. If upgrading immediately is not possible, restrict or disable access to the space administrator user import function.
$ git fetch --tags && git checkout 26.10AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Omnispace Agora Project before 26.10.0 contains a SQL identifier injection vulnerability that allows a space administrator to escalate privileges by supplying caller-controlled agoraFields[] names as unvalidated SQL column identifiers during the user import flow. Attackers can inject privileged column names such as generalAdmin or use backtick-injection techniques to set administrative flags and escalate to general administrator privileges.