Agora Project CVE-2026-63171

Requires an authenticated account holding the privilege to create or edit a forum category (PR:L) - not anonymous/unauthenticated access. The specific trigger is a forum category description containing a double-quote character that escapes the HTML input value attribute context, and exploitation depends on the application's HTMLPurifier configuration preserving double-quotes rather than encoding them. Exploitation is further limited by required victim interaction (UI:P): the payload only executes when another user actually navigates to and views the affected forum category. Impact is restricted to the victim's browser session (SC:L/SI:L); there is no direct impact on the server. Patching to Agora Project 26.10.0 removes the condition.

This is a medium-severity stored XSS (CVSS 4.0 base 5.1, CWE-79) that represents a real but low-urgency issue rather than an emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:P) shows network reach and low attack complexity, but two signals cap the real-world risk: PR:L means the attacker must already hold an authenticated account able to create or edit a forum category, and UI:P means a victim must actively browse to the affected category for the payload to fire. Impact is confined to the subsequent system (the victim's browser session): VC:N/VI:N/VA:N on the vulnerable server with only SC:L/SI:L downstream, so there is no direct server confidentiality, integrity, or availability loss. There is no EPSS score, no CISA KEV listing, and no public exploit code in the provided intelligence, so exploitation is neither confirmed nor demonstrated - the signals do not conflict, they all point to a low-to-moderate, authentication-gated threat. A vendor patch (version 26.10.0) is available, which is the decisive mitigating factor. Net: a legitimate finding worth patching in a normal maintenance cycle, not a drop-everything priority.

An attacker with a low-privileged authenticated account that can create forum categories submits a category description containing a double-quote that breaks out of an HTML input value attribute, planting a persistent script that HTMLPurifier fails to strip because its configuration preserves double-quotes. When another user - potentially an administrator - browses to that forum category, the stored script executes in their browser session. No public exploit code was identified at the time of analysis, so weaponization effort would fall on the attacker.