Agora Project CVE-2026-63157

Requires an authenticated account (PR:L) with access to the Links module in Agora Project before 26.10.0; the attacker stores a link whose 'adress' (link address) field carries a payload that uses unescaped quotes to escape the onclick event-handler attribute, because the application echoes that field into the handler without neutralizing quotes. The payload only executes when another user passively views the links list (UI:P - no click needed beyond opening the list), and impact is limited to that victim's browser context (client-side session hijacking), not the server. Limiting factors: attacker must already be a logged-in user, exploitation is confined to instances running a vulnerable pre-26.10.0 version, and a victim must actually load the links list.

This is a medium-severity stored XSS (CVSS 4.0 base 5.1, CWE-79) whose real-world risk is moderate and bounded, not urgent. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:P) shows network reach and low complexity, but two meaningful brakes apply: the attacker needs an authenticated low-privilege account (PR:L) and a victim must passively view the links list (UI:P) for the payload to fire. Impact is confined to the victim's browser session - the vector sets direct VC:N/VI:N/VA:N and only SC:L/SI:L (low subsequent-system confidentiality/integrity), consistent with session hijacking rather than direct server compromise. No EPSS score was provided, the CVE is not on CISA KEV, and no public exploit code was supplied, so exploitation status is 'no public exploit identified at time of analysis.' There are no conflicting signals here - the CVSS, CWE, and description all agree this is an authenticated, interaction-dependent client-side flaw. The main uncertainty is deployment footprint: Agora Project is a niche open-source collaboration platform, which lowers practical priority despite network exposure. A vendor patch (26.10.0) is available, making remediation straightforward.

An authenticated user of an Agora Project instance before 26.10.0 opens the Links module and saves a new link whose address (adress) field contains a payload that uses quotes to break out of the onclick attribute and inject script. When any other user - including an administrator - later browses the shared links list, the stored script executes in their browser, letting the attacker steal the session cookie or perform actions as that victim. No public proof-of-concept was provided in the source data, so weaponization effort is unverified.