CVE-2026-63150

Name of the Vulnerable Software and Affected Versions Omnispace Agora Project versions prior to 26.10.1

Description Cross-site request forgery occurs when the application merges $ GET and $ POST parameters without requiring an anti-CSRF token. This allows remote attackers to forge privileged actions, such as the creation of administrator users, by crafting malicious links or auto-navigating pages that issue plain GET requests. This exploitation leverages the lack of CSRF protection and SameSite=Lax cookie behavior during top-level navigations.

Recommendations Update Omnispace Agora Project to a version newer than 26.10.0.