{"id":"CVE-2026-63154","published":"2026-10-13T20:17:31.010","lastModified":"2026-10-15T15:12:54.040","description":"Omnispace Agora Project before 26.10.0 contains a SQL identifier injection vulnerability that allows a space administrator to escalate privileges by supplying caller-controlled agoraFields[] names as unvalidated SQL column identifiers during the user import flow. Attackers can inject privileged column names such as generalAdmin or use backtick-injection techniques to set administrative flags and escalate to general administrator privileges.","cvssScore":8.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-89"],"vendors":[],"products":[],"references":[{"url":"https://github.com/xech/agora-project/releases/tag/26.10","tags":[]},{"url":"https://www.agora-project.net/","tags":[]},{"url":"https://www.vulncheck.com/advisories/omnispace-agora-project-sql-identifier-injection-via-agorafields","tags":[]}],"exploitRefs":[{"url":"https://github.com/xech/agora-project/releases/tag/26.10","tags":[]}],"hasPoc":true,"ai":{"summary":"A SQL identifier injection vulnerability in Omnispace Agora Project allows space administrators to escalate privileges by injecting privileged column names during user import operations. This enables attackers to gain general administrator access without requiring elevated credentials.","exploitability":"Exploitation requires a space administrator account with access to the user import functionality, making it moderately difficult but achievable through social engineering or compromised admin credentials.","blast_radius":"If exploited, this vulnerability could allow attackers to fully compromise the system as general administrators, potentially affecting all users and data within the affected Omnispace Agora instances.","remediation":"Upgrade to version 26.10.0 or later to remediate the SQL identifier injection vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["privilege-escalation","sql-injection","web"],"model":"garnet-coder","analyzedAt":"2026-10-18T10:23:14.206Z"}}