CVE-2026-63152 Omnispace CVE debrief

Who should care

Defenders responsible for Omnispace Agora Project installations, especially those with authenticated access, should assess exposure and verify the effectiveness of current security controls against SQL injection attacks. This includes reviewing version numbers, ensuring parameterization of SQL statements, and monitoring for suspicious database activity.

Why it matters

CVE-2026-63152 is a high-severity vulnerability in Omnispace Agora Project that allows authenticated attackers to inject malicious SQL via the _idCategoryFilter parameter. Defenders should prioritize verifying exposure, especially in installations with authenticated access, and assess the effectiveness of current security controls against SQL injection attacks. The vulnerability can lead to unauthorized database access or manipulation, emphasizing the need for prompt verification and remediation.

• Potential for unauthorized database access or manipulation.
• Need for verification of exposure in Agora Project installations.
• Priority for upgrading to version 26.10.0 or later.
• Importance of monitoring for suspicious database activity related to the _idCategoryFilter parameter.

Technical summary

The Omnispace Agora Project before version 26.10.0 is vulnerable to a second-order SQL injection attack via the _idCategoryFilter parameter. This parameter is persisted into the session and later used in a SQL statement without proper parameterization, allowing attackers to inject malicious SQL. The vulnerability is located in app/Common/MdlCategory.php and can lead to unauthorized database access or manipulation when the filter is applied.

Defensive priority

Defenders should prioritize verifying exposure of Agora Project installations, especially those with authenticated access, and assess the effectiveness of current security controls against SQL injection attacks.

Recommended defensive actions

• Verify the version of Omnispace Agora Project and upgrade to version 26.10.0 or later if necessary.
• Implement parameterization for SQL statements to prevent injection attacks.
• Monitor for suspicious database activity, especially related to the _idCategoryFilter parameter.
• Restrict access to the app/Common/MdlCategory.php file and ensure proper session management.
• Perform a thorough review of existing database logs to identify potential past exploitation.
• Conduct an inventory of all systems using Omnispace Agora Project to prioritize remediation.
• Establish a remediation schedule for upgrading or patching vulnerable systems.

Evidence notes

The CVE record and source item provide details on the vulnerability, including its existence in versions before 26.10.0 of Omnispace Agora Project and the potential for SQL injection via the _idCategoryFilter parameter. However, specific instances of exploitation or detailed impact are not provided.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.