Stored Cross-Site Scripting Vulnerability in Omnispace Agora Project
CVE-2026-63168

5.1MEDIUM

Key Information:

Vendor

Omnispace

Status
Agora Project
Vendor
CVE Published:
13 October 2026

What is CVE-2026-63168?

The Omnispace Agora Project versions prior to 26.10.0 are susceptible to a stored cross-site scripting vulnerability. This is enabled through a flaw in the LDAP/person import flow, where authenticated users can submit unfiltered data as nested two-dimensional POST arrays. The vulnerability arises from the paramsFilter() function not adequately processing nested arrays, allowing attackers to inject malicious scripts into user profiles. When these profiles are viewed by other users, the injected scripts execute in their browsers, posing a significant security risk.

Affected Version(s)

Agora Project 0 < 26.10.0

References

https://github.com/xech/agora-project/releases/tag/26.10
release-notespatch
https://www.agora-project.net/
product
https://www.vulncheck.com/advisories/omnispace-agora-proj...
third-party-advisory

CVSS V4

Score:
5.1
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Geoffrey Robert of akailabs
.