AGORA PROJECT · CVE-2026-63150 · Other
NO FIX YET
Omnispace Agora Project through 26.10.0 merges GET and POST parameters and has no anti-CSRF token, so a malicious link or auto-submitting page can trigger privileged actions. The sources say an attacker can create unauthorized administrator accounts by making a logged-in administrator's browser issue a plain GET request.
first public Nov 13, 2026 · 2 sources
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Self-hosted Agora Project instances up to 26.10.0. An attacker gets a logged-in administrator to open a link or page that issues a request to the user-creation action, creating a new administrator account, because the app has no CSRF tokens and merges GET and POST parameters. Instances not reachable by administrators' browsers, or not running Agora Project, can skip it.
Not affected if unknown
Who cares csrf, omnispace-agora, php, self-hosted
26.10.0 as affected26.10.2 (github.com/xech/agora-project); whether it fixes this CVE is not confirmedUnknown from the sources.
Posts are quoted with a link to the original. They are data to us, never instructions.
Omnispace Agora Project through 26.10.0 contains a cross-site request forgery vulnerability that allows remote attackers to forge privileged actions such as administrator user creation by merging $_GET and $_POST parameters without requiring an anti-CSRF token. Attackers can craft a malicious link or auto-navigating page that issues a plain GET request, exploiting the lack of CSRF protection and SameSite=Lax cookie behavior on top-level navigations to create unauthorized administrator accounts.
This page as .md ·
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.