CVE-2026-63168 in Agora Project
Summary
by MITRE • 10/14/2026
Omnispace Agora Project before 26.10.0 contains a stored cross-site scripting vulnerability that allows authenticated attackers to persist unneutralized markup by submitting malicious values as two-dimensional POST arrays through the LDAP/person import flow, bypassing the paramsFilter() request parameter filter which failed to recurse into nested arrays. Attackers can inject arbitrary script code into a user profile that is later rendered to other users, resulting in execution of malicious scripts in victims' browsers.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/14/2026
The Omnispace Agora Project version 26.10.0 and earlier contains a critical stored cross-site scripting vulnerability located within the LDAP or person import functionality. This flaw stems from an insufficient validation mechanism when processing user-supplied input, specifically targeting two-dimensional POST arrays submitted during the data import process. The application's security controls rely on a request parameter filter known as paramsFilter() to sanitize incoming data and prevent malicious code injection. However, this filtering logic is flawed because it fails to recursively inspect nested array structures. Consequently, attackers can bypass these protective measures by embedding unneutralized markup within deeply nested arrays, allowing the malicious payload to persist in the system's backend storage rather than being immediately rejected or sanitized at the point of entry.
This vulnerability allows authenticated users with access to the LDAP import feature to inject arbitrary script code into user profile records. Because the application stores this input without proper encoding or escaping, the injected scripts are rendered directly when other authorized users view these profiles in their web browsers. This persistence mechanism transforms a simple injection flaw into a severe stored cross-site scripting attack vector. Unlike reflected XSS where the payload is only executed during a specific request, here the malicious code becomes part of the application's content, ensuring that every user who accesses the compromised profile will trigger the execution of the attacker's script in their own browser context.
The operational impact of this vulnerability extends beyond simple defacement or session hijacking. Attackers can leverage the injected scripts to perform a variety of malicious actions on behalf of victims. These include stealing sensitive authentication tokens and cookies, performing unauthorized administrative actions within the Omnispace Agora Project interface, capturing keystrokes entered by legitimate users, or redirecting victims to phishing sites designed to harvest credentials. Given that this vulnerability requires initial authentication, it poses a significant risk in environments where insider threats are possible or when attacker accounts have been compromised through other means such as credential stuffing or social engineering. The ability to bypass the paramsFilter() suggests a systemic weakness in how the application handles complex data structures, potentially exposing other endpoints with similar input handling logic to analogous attacks.
From a classification perspective, this vulnerability aligns with CWE-79 Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting. Specifically, it represents Stored XSS where malicious scripts are permanently stored on the target server and executed when users retrieve the data. In terms of offensive security frameworks, this maps to MITRE ATT&CK technique T1059 Command and Control via Browser-based Execution or more broadly to Initial Access vectors involving compromised accounts if used for further exploitation. The failure to recurse into nested arrays indicates a lack of robust input validation strategies that should account for complex data structures rather than only flat parameters.
To mitigate this vulnerability, immediate patching to version 26.10.0 or later is required as it addresses the recursive filtering issue. In the interim, administrators should restrict access to the LDAP import functionality to a minimal set of trusted users and enforce strict role-based access controls. Input validation mechanisms must be updated to recursively traverse all nested arrays and apply context-appropriate encoding such as HTML entity encoding for any data that will be rendered in web pages. Additionally implementing Content Security Policy headers can help mitigate the impact by restricting the sources from which scripts are allowed to execute, thereby reducing the effectiveness of injected payloads even if they bypass server-side filters. Regular security audits focusing on complex input handling and recursive validation logic should also be conducted to prevent similar oversights in other parts of the application.