CVE-2026-63168: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Omnispace Agora Project

Omnispace Agora Project prior to version 26.10.0 contains a stored XSS vulnerability due to improper neutralization of input during web page generation. The vulnerability arises because the paramsFilter() function fails to recurse into nested two-dimensional POST arrays, allowing authenticated attackers to submit malicious markup through the LDAP/person import flow. This malicious input is stored in user profiles and later rendered to other users, enabling script execution in their browsers.

The vulnerability allows authenticated attackers to inject and persist malicious scripts in user profiles. When other users view these profiles, the injected scripts execute in their browsers, potentially leading to session hijacking, credential theft, or other malicious actions within the context of the affected web application. The CVSS 4.0 base score is 5.1, indicating a medium severity impact with network attack vector, low attack complexity, and required privileges and user interaction.

No explicit patch or remediation information is provided. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the LDAP/person import functionality to trusted users only and consider additional input validation or filtering on nested POST arrays to mitigate exploitation.