CVE-2026-63165 Omnispace CVE debrief

Who should care

Defenders responsible for Omnispace Agora Project installations, especially those exposed to the internet or used by multiple users, should assess their exposure and prioritize patching or mitigating this vulnerability.

Why it matters

This SQL injection vulnerability in Omnispace Agora Project before version 26.10.0 allows attackers to inject malicious SQL, potentially leading to data extraction or modification, disruption of calendar functionality, and requires defenders to implement input validation and sanitization, monitoring, and incident response planning.

• Potential data extraction or modification through SQL injection
• Possible disruption of calendar functionality
• Need for input validation and sanitization implementation
• Requirement for monitoring and incident response planning

Technical summary

The Omnispace Agora Project before version 26.10.0 contains a SQL injection vulnerability in the calendar functionality. The vulnerability is caused by the lack of sanitization of the sortEvents parameter, which is concatenated into the ORDER BY clause in app/ModCalendar/CtrlCalendar.php. This allows attackers to inject malicious SQL using error-based techniques. Defenders should be aware of the potential for data extraction or modification, disruption of calendar functionality, and the need for input validation and sanitization, monitoring, and incident response planning. The CVE record and source item provide details about the vulnerability, including its location in the calendar functionality and the

Defensive priority

Defenders should prioritize patching or mitigating this vulnerability, especially for systems exposed to the internet or used by multiple users.

Recommended defensive actions

• Patch or upgrade to version 26.10.0 or later
• Implement input validation and sanitization for the sortEvents parameter
• Monitor for suspicious activity and error messages
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source item provide details about the vulnerability, including its location in the calendar functionality and the affected parameter. However, there is limited information about potential exploits or attacks.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.