CVE-2026-63168

Deferred Deferred - Pending Action

Stored XSS in Omnispace Agora Project via LDAP Import

Publication date: 2026-10-13

Last updated on: 2026-10-18

Assigner: VulnCheck

Description

Omnispace Agora Project before 26.10.0 contains a stored cross-site scripting vulnerability that allows authenticated attackers to persist unneutralized markup by submitting malicious values as two-dimensional POST arrays through the LDAP/person import flow, bypassing the paramsFilter() request parameter filter which failed to recurse into nested arrays. Attackers can inject arbitrary script code into a user profile that is later rendered to other users, resulting in execution of malicious scripts in victims' browsers.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-13

Last Modified

2026-10-18

Generated

2026-10-19

AI Q&A

2026-10-14

EPSS Evaluated

2026-10-18

NVD

CVE-2026-63168

EUVD

EUVD-2026-100476

Affected Vendors & Products

Vendor	Product	Version / Range
Omnispace	Agora	Project 0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This vulnerability is a stored cross-site scripting (XSS) flaw in Omnispace Agora Project versions before 26.10.0. It allows authenticated attackers to inject malicious script code into user profiles via LDAP/person import using two-dimensional POST arrays. The paramsFilter() function fails to properly sanitize nested arrays, enabling the bypass of input validation.

Detection Guidance

To detect this vulnerability, inspect HTTP POST requests to the LDAP/person import endpoint for nested arrays containing unneutralized markup. Check user profiles for injected script code in fields like name or description. Monitor browser console logs for unexpected script execution when viewing profiles.

Impact Analysis

If exploited, this vulnerability could allow attackers to execute arbitrary scripts in the browsers of other users who view the compromised profile. This may lead to session hijacking, theft of sensitive data, or unauthorized actions performed on behalf of the victim.

Compliance Impact

This vulnerability could lead to data breaches, exposing personal or sensitive information. Such incidents may violate GDPR's data protection requirements or HIPAA's safeguards for protected health information, potentially resulting in legal penalties, reputational damage, and loss of trust.

Mitigation Strategies

Upgrade Omnispace Agora Project to version 26.10.0 or later. Implement strict input validation for all user-submitted data, especially nested arrays. Apply output encoding to user profile fields to neutralize any injected markup. Review and restrict LDAP/person import permissions to trusted users only.

Hi! I’m here to help you understand CVE-2026-63168. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70