{"id":"CVE-2026-63150","kind":"vulnerability","aliases":["CVE-2026-63150"],"related":[],"title":"Omnispace Agora Project: cross-site request forgery lets attackers create administrator accounts","description":"Omnispace Agora Project through 26.10.0 contains a cross-site request forgery vulnerability that allows remote attackers to forge privileged actions such as administrator user creation by merging $_GET and $_POST parameters without requiring an anti-CSRF token. Attackers can craft a malicious link or auto-navigating page that issues a plain GET request, exploiting the lack of CSRF protection and SameSite=Lax cookie behavior on top-level navigations to create unauthorized administrator accounts.","summary":"Omnispace Agora Project through 26.10.0 merges GET and POST parameters and has no anti-CSRF token, so a malicious link or auto-submitting page can trigger privileged actions. The sources say an attacker can create unauthorized administrator accounts by making a logged-in administrator's browser issue a plain GET request.","severity":"high","cvss":8.6,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Agora Project","fixed":[],"affected":"<= 26.10.0","ecosystem":"vendor"}],"ecosystems":[],"tags":["csrf","omnispace-agora","other","php","self-hosted"],"not_affected_if":["unknown"],"how_to_check":"Check your Agora Project version (admin panel or the app's version string); the NVD record lists everything up to and including 26.10.0 as affected. Also check whether the session cookie lacks SameSite/HttpOnly/Secure. Latest release found is 26.10.2 (github.com/xech/agora-project); whether it fixes this CVE is not confirmed.","fix":null,"status":"open","published_at":"2026-11-13T17:17:33+00:00","first_seen_at":"2026-11-13T17:48:02+00:00","triaged_at":"2026-11-13T17:48:42+00:00","updated_at":"2026-11-13T17:50:34+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-11-13T17:48:42Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Omnispace Agora Project: cross-site request forgery lets attackers create administrator accounts","impact":"high","summary":"Omnispace Agora Project through 26.10.0 merges GET and POST parameters and has no anti-CSRF token, so a malicious link or auto-submitting page can trigger privileged actions. The sources say an attacker can create unauthorized administrator accounts by making a logged-in administrator's browser issue a plain GET request.","audience":"businesses","category":"other","nicknames":[],"who_cares":["omnispace-agora","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker creates an administrator account on the application","analyst_note":"Find the vendor advisory or product repository to confirm a fixed version, affected deployment defaults and any workaround for Omnispace Agora Project.","how_to_check":"- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"Teams running Omnispace Agora Project 26.10.0 or earlier where an administrator may visit untrusted links while logged in. The sources do not describe default configuration or which deployments are reachable from the internet, so the exact exposure is unknown.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000706,"input_tokens":4622,"output_tokens":487,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the vendor advisory or product repository to confirm a fixed version, affected deployment defaults and any workaround for Omnispace Agora Project.","search":"'-2026':15A,18A '-63150':16A,19A '26.10.0':35B,89C 'account':13A,70B,161C 'action':60B,105C 'administr':12A,69B,77B,108C,160C 'agora':2A,20A,25B,32B,86C 'allow':99C 'anti':45B,121C 'anti-csrf':44B,120C 'attack':10A,65B,101C,124C 'auto':54B,132C 'auto-navig':131C 'auto-submit':53B 'behavior':151C 'browser':79B 'contain':90C 'cooki':150C 'craft':126C 'creat':11A,67B,158C 'creation':110C 'cross':5A,93C 'cross-sit':4A,92C 'csrf':22B,46B,122C,145C 'cve':14A,17A 'exploit':141C 'forg':103C 'forgeri':8A,96C 'get':37B,83B,113C,139C 'host':30B 'issu':80B,136C 'lack':143C 'lax':149C 'let':9A 'level':155C 'link':51B,129C 'log':75B 'logged-in':74B 'make':72B 'malici':50B,128C 'merg':36B,112C 'navig':133C,156C 'omnispac':1A,24B,31B,85C 'omnispace-agora':23B 'page':56B,134C 'paramet':40B,116C 'php':27B 'plain':82B,138C 'post':39B,115C 'privileg':59B,104C 'project':3A,21A,33B,87C 'protect':146C 'remot':100C 'request':7A,84B,95C,140C 'requir':118C 'samesit':148C 'say':63B 'self':29B 'self-host':28B 'site':6A,94C 'sourc':62B 'submit':55B 'token':47B,123C 'top':154C 'top-level':153C 'trigger':58B 'unauthor':68B,159C 'user':109C 'vulner':97C 'without':117C","nicknames":[],"mitigations":[],"who_affected":"Self-hosted Agora Project instances up to 26.10.0. An attacker gets a logged-in administrator to open a link or page that issues a request to the user-creation action, creating a new administrator account, because the app has no CSRF tokens and merges GET and POST parameters. Instances not reachable by administrators' browsers, or not running Agora Project, can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":["agoraproject","project"],"ptokens":["agora","project"],"labels":["csrf","high","omnispaceagora","other","php","selfhosted"],"campaign_type":null,"search_a":"'-2026':15A,18A '-63150':16A,19A 'account':13A 'administr':12A 'agora':2A,20A 'attack':10A 'creat':11A 'cross':5A 'cross-sit':4A 'cve':14A,17A 'forgeri':8A 'let':9A 'omnispac':1A 'project':3A,21A 'request':7A 'site':6A","search_b":"'26.10.0':35B 'account':70B 'action':60B 'administr':69B,77B 'agora':25B,32B 'anti':45B 'anti-csrf':44B 'attack':65B 'auto':54B 'auto-submit':53B 'browser':79B 'creat':67B 'csrf':22B,46B 'get':37B,83B 'host':30B 'issu':80B 'link':51B 'log':75B 'logged-in':74B 'make':72B 'malici':50B 'merg':36B 'omnispac':24B,31B 'omnispace-agora':23B 'page':56B 'paramet':40B 'php':27B 'plain':82B 'post':39B 'privileg':59B 'project':33B 'request':84B 'say':63B 'self':29B 'self-host':28B 'sourc':62B 'submit':55B 'token':47B 'trigger':58B 'unauthor':68B","search_c":"'26.10.0':89C 'account':161C 'action':105C 'administr':108C,160C 'agora':86C 'allow':99C 'anti':121C 'anti-csrf':120C 'attack':101C,124C 'auto':132C 'auto-navig':131C 'behavior':151C 'contain':90C 'cooki':150C 'craft':126C 'creat':158C 'creation':110C 'cross':93C 'cross-sit':92C 'csrf':122C,145C 'exploit':141C 'forg':103C 'forgeri':96C 'get':113C,139C 'issu':136C 'lack':143C 'lax':149C 'level':155C 'link':129C 'malici':128C 'merg':112C 'navig':133C,156C 'omnispac':85C 'page':134C 'paramet':116C 'plain':138C 'post':115C 'privileg':104C 'project':87C 'protect':146C 'remot':100C 'request':95C,140C 'requir':118C 'samesit':148C 'site':94C 'token':123C 'top':154C 'top-level':153C 'unauthor':159C 'user':109C 'vulner':97C 'without':117C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T17:17:33+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-63150","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63150","severity":null,"published_at":"2026-11-13T17:17:33+00:00","modified_at":"2026-11-13T17:17:33+00:00","first_seen_at":"2026-11-13T17:48:02+00:00","fetched_at":"2026-11-13T17:48:02+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-63150:3914","url":"https://www.akailabs.fr/blog/multiple-vulnerabilities-in-agora-project-26-5-2","severity":null,"published_at":"2026-11-13T17:50:34+00:00","modified_at":"2026-11-13T17:50:34+00:00","first_seen_at":"2026-11-13T17:50:34+00:00","fetched_at":"2026-11-13T17:50:34+00:00","note":"NVD (VulnCheck CNA) and Akailabs write-up read; no vendor advisory. Akailabs says 8 of 29 CVEs remain unfixed and this CVE was published Nov 13 after the 21 validated fixes (Oct 13), so fix status is unclear: a Sep 21 release was said to address 63146-63165, but the retest result for this one isn't stated. Fix unknown, nothing verified. Search and X not used. Severity unchanged.","cites":["https://www.akailabs.fr/blog/multiple-vulnerabilities-in-agora-project-26-5-2","https://github.com/xech/agora-project/releases/tag/26.10","https://nvd.nist.gov/vuln/detail/CVE-2026-63150"]}],"documents":[{"id":148157,"url":"https://www.akailabs.fr/blog/multiple-vulnerabilities-in-agora-project-26-5-2","title":"Akailabs: Multiple vulnerabilities in Agora-Project","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":148154,"url":"https://github.com/xech/agora-project/releases/tag/26.10","title":"Agora Project 26.10.2 release","kind":"release","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null},{"id":148159,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63150","title":"NVD CVE-2026-63150","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}