CVE-2026-63154

Omnispace Agora Project versions prior to 26.10.0 are vulnerable to a SQL identifier injection vulnerability during the user import flow. The root cause is the use of unvalidated caller-controlled agoraFields[] names as SQL column identifiers. A space administrator can exploit this to escalate pr...