Omnispace Agora Project: Second-order SQL injection via _idCategoryFilter
Summary
Omnispace Agora Project, an open-source team collaboration platform, contains a second-order SQL injection vulnerability (CWE-89) in the _idCategoryFilter parameter. An authenticated user can store a malicious filter value in the session, which is later concatenated into a SQL statement without parameterization when the filter is applied in app/Common/MdlCategory.php. A successful attack can lead to unauthorized reading, modification or deletion of database content. The attacker needs a valid low-privilege account, and no user interaction is required.
Affected
- Omnispace Agora Project versions before 26.10.0 (affected range 0 to below 26.10.0 according to the CNA record)
Fixed in
- Version 26.10.0 or later (the vendor release tag 26.10 is referenced; later 26.10.x builds are available, verify the latest release on the GitHub releases page)
Workaround
Unknown.
Exploitation
- No evidence of active exploitation found.
- No public proof of concept found; status treated as unknown.
- CISA SSVC: Exploitation none, Automatable no, Technical Impact total.
- Not listed in CISA KEV according to one aggregator.
Our recommendation
- Identify all Agora Project instances and their versions, including those installed via hosting-panel installers.
- Upgrade internet-facing instances first, then internal ones, to the latest 26.10.x release.
- Limit accounts to trusted users and review whether self-registration or external guest accounts are enabled.
- Apply least privilege to the database account used by the application.
- Review logs for unusual filter values.
- Patch the other CVEs in the same release batch, several of which are more severe.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub release 26.10 github.com
- VulnCheck advisory www.vulncheck.com
- Agora Project website www.agora-project.net
- OSV entry CVE-2026-63152 osv.dev
- Softaculous update to 26.10.0 www.softaculous.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 08:23.
Original description (NVD)
Omnispace Agora Project before 26.10.0 contains a second-order SQL injection vulnerability that allows authenticated attackers to inject malicious SQL via the _idCategoryFilter parameter, which is persisted into the session and later concatenated into a SQL statement without parameterization. Attackers can store a malicious payload that executes when the filter is subsequently applied in app/Common/MdlCategory.php, leading to unauthorized database access or manipulation.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.