CVE-2026-63154 Omnispace Agora Project < 26.10.0 SQL Identifier Injection via agoraFields[]
A space administrator can escalate privileges to general administrator by injecting SQL identifiers during user import in Agora Project.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-63154?
CVE-2026-63154 is a high-severity SQL injection vulnerability in Omnispace Agora Project, published on 13 Oct 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Omnispace Agora Project before 26.10.0 contains a SQL identifier injection vulnerability that allows a space administrator to escalate privileges by supplying caller-controlled agoraFields[] names as unvalidated SQL column identifiers during the user import flow. Attackers can inject privileged column names such as generalAdmin or use backtick-injection techniques to set administrative flags and escalate to general administrator privileges.
Weakness: CWE-89
Which versions are affected by CVE-2026-63154?
How do I fix CVE-2026-63154?
No fix has been published for CVE-2026-63154 yet. Limit exposure of the affected software until one is available.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2026-63154 being exploited?
There is no known exploitation of CVE-2026-63154 in the wild and no public exploit code.
Sources
Also known as GHSA-rv94-x83p-g9w2.