Stored Cross-Site Scripting in Omnispace Agora Project Affects Authenticated Users
CVE-2026-63157

5.1MEDIUM

Key Information:

Vendor

Omnispace

Status
Agora Project
Vendor
CVE Published:
13 October 2026

What is CVE-2026-63157?

The Omnispace Agora Project prior to version 26.10.0 is susceptible to a stored cross-site scripting vulnerability that allows authenticated users to execute malicious scripts. This occurs when an unsanitized link address is submitted through the Links module, allowing crafted payloads to be stored and executed when any user accesses the links list. This vulnerability could lead to serious security threats, including session hijacking and further compromises on the client-side.

Affected Version(s)

Agora Project 0 < 26.10.0

References

https://github.com/xech/agora-project/releases/tag/26.10
release-notespatch
https://www.agora-project.net/
product
https://www.vulncheck.com/advisories/omnispace-agora-proj...
third-party-advisory

CVSS V4

Score:
5.1
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Geoffrey Robert of akailabs
.