External risk intelligence

Omnispace Agora Project Code Injection and Installer Re-trigger Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-63146

The vulnerability affects a web application installation process and core configuration management. As a web-based project management system, it is commonly deployed as an internet-facing or intranet-facing web application, making its installation and management interface a likely target for remote access when exposed.

Code Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability in Omnispace Agora Project allows unauthenticated remote code execution by exploiting weaknesses in its installation and configuration process. This could enable an attacker to inject malicious code into the system.

Unauthenticated code injection via installation.
Remote code execution poses significant risk.
Confirm relevance and assess potential exposure.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by first leveraging an SQL injection flaw to re-initiate the application's installer. During this re-installation process, the attacker could then inject malicious PHP code into the system's configuration file, ultimately leading to unauthenticated remote code execution.

Entry condition: Network access to the application's installer.
Trigger point: Re-triggering the installer via SQL injection.
Resulting risk: Unauthenticated remote code execution.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated remote attacker to execute arbitrary PHP code on the underlying system. This occurs when an attacker can exploit an SQL injection flaw to re-trigger the installation process and inject malicious code into the configuration file.

System-wide remote code execution.
Exploits installer and configuration writes.
Complete system compromise possible.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability impacts the installation and configuration process of web applications. Application owners or platform teams responsible for deployment should first identify all instances of the affected technology, confirm their exposure and criticality, and then coordinate with vendor management if applicable to plan remediation.

Application owners must confirm affected systems.
Verify installation interfaces are secured.
Plan remediation based on exposure.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Omnispace Agora Project?

Omnispace Agora Project is a web-based groupware and project management platform. It provides tools for teams to collaborate through features like calendars, document management, and discussion forums, typically hosted on web servers to facilitate team communication.

What does CVE-2026-63146 mean for my system?

This CVE involves CWE-94, which is the improper control of code generation. In this case, the application fails to properly sanitize input during its installation and configuration routines. This creates a weakness where an attacker can trick the system into writing malicious PHP code into its own configuration files, effectively allowing them to run unauthorized commands.

How can an attacker trigger this vulnerability?

An attacker needs to gain access to the application's installer mechanism. They achieve this by using an SQL injection flaw to re-trigger the installation process. Note that simply interacting with the standard user interface does not trigger the bug; the attacker must specifically manipulate the database to restart the setup flow, which then enables the code injection.

Is my instance at risk according to Halo Surface Signal?

Halo Surface Signal identifies this as a 'Likely' risk because the software is a web application. It is commonly deployed in ways that are accessible over a network, making the installation and configuration interfaces frequent targets. Systems reachable from the internet face the highest risk, but even intranet-facing deployments are potentially vulnerable if accessible to unauthorized internal users.

What steps should I take to respond to this issue?

First, inventory your environment to locate all instances of Omnispace Agora Project. Verify whether these instances are reachable over a network. Once identified, restrict access to the installation and configuration interfaces immediately to prevent unauthorized re-triggers while you plan and implement the necessary vendor-provided updates.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.