Agora Project CVE-2026-63154

Exploitation requires an authenticated account with space-administrator privileges and access to the user import flow, where the attacker controls the agoraFields[] parameter so that supplied values are used directly as SQL column identifiers. The concrete trigger is injecting a privileged column name such as generalAdmin, or using backtick-injection to escape the identifier context, to set administrative flags. The primary limiting factor is the PR:L requirement - only existing space administrators (not anonymous or ordinary users) can reach the vulnerable import code path; no additional user interaction or non-default configuration is indicated, and it is fixed in Agora Project 26.10.0.

This is a credible but not emergency-tier priority. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) describes a network-reachable, low-complexity attack requiring low privileges and no user interaction, with high confidentiality, integrity and availability impact to the vulnerable system (VC:H/VI:H/VA:H) and no scope change (SC/SI/SA:N), yielding 8.7 (High). The key limiting signal is PR:L: the attacker must already hold space-administrator rights, so this is a privilege-escalation/trust-boundary flaw rather than a pre-auth takeover - it converts a delegated, lower-tier admin into a full general administrator. No EPSS score was provided in the input, and there is no CISA KEV listing and no public exploit referenced, so there is no evidence of active exploitation; exploitation status is 'no public exploit identified at time of analysis.' The disclosure comes from VulnCheck with a vendor patch available, which raises confidence that the issue is real and fixable, but the absence of exploitation-probability data and the authenticated-insider prerequisite argue for prompt-but-scheduled patching rather than crisis response. One mild tension to verify: AV:N is appropriate for a web-based import flow, yet the realistic attacker is an existing privileged insider, so the practical exposure is narrower than a raw 'network' label suggests.

A user who holds only space-administrator rights opens the user import feature and submits an import request where the agoraFields[] column names are attacker-chosen rather than legitimate field names. By supplying a privileged identifier such as generalAdmin (or using backtick-injection to break out of the column context), the attacker sets administrative flags on an account and is promoted to general administrator. No public exploit code was identified in the provided data, but the technique is fully described in the VulnCheck advisory.