GHSA-2wjc-h33p-6wrrHighCVSS 8.1
Omnispace Agora Project through 26.10.0 contains a cross-site request forgery vulnerability that...
🔗 CVE IDs covered (1)
📋 Description
Omnispace Agora Project through 26.10.0 contains a cross-site request forgery vulnerability that allows remote attackers to forge privileged actions such as administrator user creation by merging $_GET and $_POST parameters without requiring an anti-CSRF token. Attackers can craft a malicious link or auto-navigating page that issues a plain GET request, exploiting the lack of CSRF protection and SameSite=Lax cookie behavior on top-level navigations to create unauthorized administrator accounts.
🔗 References (5)
- https://nvd.nist.gov/vuln/detail/CVE-2026-63150
- https://www.agora-project.net
- https://www.akailabs.fr/blog/multiple-vulnerabilities-in-agora-project-26-5-2#cve-2026-63150-no-csrf-protection-and-unsecure-cookies-leads-to-administrator-cr
- https://www.vulncheck.com/advisories/omnispace-agora-project-csrf-via-administrator-account-creation
- https://github.com/advisories/GHSA-2wjc-h33p-6wrr