Agora Project CVE-2026-63152

Exploitation requires a valid authenticated session on the Agora Project application (CVSS PR:L), since the malicious _idCategoryFilter value must be persisted into the attacker's own server-side session. Because it is a second-order injection, the payload executes only after the category filter is subsequently applied in app/Common/MdlCategory.php - not at the moment of submission - but no special non-default configuration, feature toggle, or user interaction from a victim is needed. The primary limiting factor is the authentication requirement: unauthenticated outsiders cannot reach the sink, so realistic risk concentrates in deployments that grant accounts to low-trust or numerous users. All versions before 26.10.0 are affected; upgrading to 26.10.0 removes the condition.

This is a genuine but conditional priority rather than an unconditional emergency. The CVSS 4.0 base score of 8.6 (High) reflects a network-reachable vector (AV:N), low attack complexity (AC:L), no user interaction (UI:N), and high confidentiality and integrity impact (VC:H/VI:H), tempered only by the requirement for low-level authentication (PR:L). Crucially, this is a second-order (stored) SQL injection: the payload is persisted into the session via _idCategoryFilter and only fires when the filter is later applied in app/Common/MdlCategory.php, so exploitation is near-certain to succeed once an attacker has any authenticated account, but it does require that account. No EPSS score, CISA KEV listing, or public POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation - the risk is derived from the vulnerability's intrinsic severity, not observed attacker interest. The SSVC-style read is: exploitation is not confirmed in the wild, automatability is limited by the authentication requirement, but technical impact is total for the database. Net: patch promptly, especially where untrusted or low-trust users hold accounts, but this is not a mass-exploitation 'drop everything' scenario absent KEV/EPSS signals.

An attacker with a low-privilege authenticated account on an Agora Project collaboration instance submits a crafted _idCategoryFilter value containing SQL metacharacters, which is stored in their session rather than immediately executed. When the category filter is subsequently applied (by the attacker's own navigation), the unparameterized value is concatenated into a query in MdlCategory.php and executed, letting the attacker read or manipulate arbitrary database contents. No public exploit code was provided, so weaponization would require independent development against the known injection point.