AGORA-PROJECT · CVE-2026-63167 · Other
NO FIX YET
Omnispace Agora Project through 26.10.0 concatenates the personsSort session value unsanitized into ORDER BY clauses in MdlUser.php and MdlSpace.php. An authenticated general administrator can inject arbitrary SQL and leak database information, such as the MariaDB version, through the user and space listing pages.
first public Nov 13, 2026 · 2 sources
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Teams that run Omnispace Agora Project through version 26.10.0 are exposed, and the attacker must already hold a general administrator account. The sources name the user and space listing pages as the injection path. Installations without general administrator accounts in use are less exposed, but the sources do not say more.
Not affected if auth-required, no-admin-accounts-exposed
Who cares auth-required, omnispace-agora, php, self-hosted, sql-injection
26.10.0 are listed as affected26.10.5) do not mention itNo fix yet, per the sources.
Omnispace Agora Project through 26.10.0 contains a SQL injection vulnerability that allows authenticated general administrators to inject arbitrary SQL by setting the personsSort session value, which is concatenated unsanitized into ORDER BY clauses in MdlUser.php and MdlSpace.php. Attackers can submit an error-based extractvalue payload through personsSort to leak database information, such as the MariaDB version, via the user and space listing pages.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.