CVE-2026-63154

Summary

A SQL identifier injection vulnerability in Omnispace Agora Project allows space administrators to escalate privileges by injecting privileged column names during user import operations. This enables attackers to gain general administrator access without requiring elevated credentials.

Exploitability

Exploitation requires a space administrator account with access to the user import functionality, making it moderately difficult but achievable through social engineering or compromised admin credentials.

Blast radius

If exploited, this vulnerability could allow attackers to fully compromise the system as general administrators, potentially affecting all users and data within the affected Omnispace Agora instances.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to version 26.10.0 or later to remediate the SQL identifier injection vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.