9.3 CVSS: Omnispace Agora SQLi Leads to Unauthenticated RCE in Pre-26.10.0 Versions

Omnispace Agora software versions prior to 26.10.0 contain a critical security flaw that allows attackers to run arbitrary code on the server without needing to log in. This vulnerability, identified as CVE-2026-63146, has been assigned a CVSS score of 9.3, classifying it as Critical severity according to the National Vulnerability Database. The issue stems from how the application handles data during its installation process.

The risk

The vulnerability exists because the application fails to properly escape user-controlled values during installation. These unescaped values are written directly into the config.inc.php configuration file. This occurs through specific functions, including File::updateConfigFile() and DbInstall::dbControl(), according to the NVD record. The weakness is categorized under CWE-94, which relates to code injection flaws.

Attackers can exploit this by leveraging an associated SQL injection issue. The database connection uses PDO::ATTR_EMULATE_PREPARES, a setting that supports stacked queries. This configuration allows an attacker to manipulate the SQL injection to re-trigger the installer mechanism. Once the installer is re-triggered, the attacker can inject arbitrary PHP code into the configuration file, achieving full remote control of the underlying system.

Who is exposed

Any organization or individual running Omnispace Agora Project versions earlier than 26.10.0 is exposed to this threat. The National Vulnerability Database lists the affected product as Omnispace Agora Project before 26.10.0. Because the exploitation does not require authentication, any system accessible to the attacker is potentially vulnerable. There is no indication in the source material that specific configurations or environments mitigate this risk.

Cost and compliance

The source material does not provide information regarding financial costs, regulatory compliance impacts, or specific legal liabilities associated with this vulnerability. The National Vulnerability Database record focuses solely on the technical details of the flaw, its severity rating, and the affected software versions. No details about data breaches, fines, or remediation costs are included in the provided records.

What should you do?

Managers should immediately audit their environments to identify any instances of Omnispace Agora running versions prior to 26.10.0. Teams should restrict network access to the installation endpoints to limit exposure until a fix is available. Monitoring logs for unusual installer activity or unexpected changes to configuration files is also recommended.

The background in plain language

Teams usually rely on configuration files to store essential settings for applications. When these files are modified during installation, they must be protected from malicious input. Code injection occurs when an application executes data as if it were legitimate programming instructions. SQL injection allows attackers to interfere with database queries.

When combined, these flaws can bypass security controls. Check whether your systems validate all inputs during setup phases. Ensure that database connections use prepared statements securely. Verify that configuration files are not writable by external processes after installation. Review access controls to prevent unauthorized re-triggering of setup routines.

Background: Data breaches

Detect breaches by establishing a strict baseline of normal network and user behavior. Monitor for impossible travel, unusual data egress volumes, and command-line activity. Correlate these signals across identity, endpoint, and network layers to catch stealthy exfiltration.

Read the full guide: Detect Data Breaches: Hidden Signals in Logs and System Behavior

What to do and how to stay safe: Omnispace Agora

• Identify all servers running Omnispace Agora versions before 26.10.0 and isolate them from untrusted networks.
• Monitor web server logs for repeated installation requests or unusual activity targeting the config.inc.php file.
• Review database configurations to ensure that stacked queries are disabled or properly mitigated in other applications.
• Await an official update from the vendor and test it in a non-production environment before deployment.

Step-by-step guide: Zero-Day Vulnerabilities Meaning: How Unpatched Flaws Bypass Your Defenses

General security guidance from the Vector Tribune newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the CVE ID for this vulnerability?

The CVE ID for this vulnerability is CVE-2026-63146.

What is the CVSS score for CVE-2026-63146?

The CVSS score for CVE-2026-63146 is 9.3, which is rated as Critical.

Which versions of Omnispace Agora are affected?

All versions of Omnispace Agora Project before version 26.10.0 are affected.