Agora Project CVE-2026-63165

Requires an authenticated low-privileged user session (PR:L) with access to the calendar functionality of Agora Project before 26.10.0; the attacker manipulates the sortEvents parameter, which is concatenated directly into a SQL ORDER BY clause in app/ModCalendar/CtrlCalendar.php without sanitization. Exploitation works against default configurations once authenticated - no special non-default feature toggle is named - but the authentication requirement is the primary limiting factor, meaning anonymous internet-wide exploitation is not possible and the attacker must first obtain valid (even low-privilege) credentials.

Signals are moderately consistent and point to a real but not top-tier priority. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) describes a network-reachable, low-complexity attack requiring low privileges, which matches a SQL injection in an authenticated calendar feature. No EPSS score was provided, the CVE is not on CISA KEV, and no public POC was supplied in the input - so this is not confirmed to be under active exploitation. The vendor vector rates both confidentiality and integrity high (VC:H/VI:H), but the description only demonstrates read-oriented, error-based extraction (extractvalue) of data such as the DB version, which supports a high confidentiality impact more clearly than a high integrity impact; the integrity rating should be verified against the actual query context. Overall this is a genuine authenticated SQLi with a vendor patch available, worth prioritizing for organizations running Agora Project, but mitigated by the authentication requirement and the product's limited deployment footprint rather than being a mass-exploitation emergency.

An attacker with a low-privileged authenticated account on an Agora Project instance opens the calendar module and supplies a crafted sortEvents value that is concatenated unsanitized into the ORDER BY clause. Using an error-based payload such as extractvalue(), they coerce the database into returning sensitive information (e.g., schema and version data) through error messages. No public exploit code was identified in the provided data, but the technique is well-understood and trivial to reproduce.