A space administrator can manipulate the agoraFields[] array to inject arbitrary SQL column names during user import, allowing the injection of privileged columns such as generalAdmin or the use of backtick‑based syntax to set administrative flags. This flaw can elevate a normal administrator to a general administrator, granting full control over the Agora Project instance without additional credentials.

The vulnerability affects all releases of the Omnispace Agora Project older than version 26.10.0. Administrators of any site running those versions are at risk.

The CVSS base score of 8.7 indicates high exploitation severity. The EPSS score is under 1 %, suggesting it is currently rarely exploited in the wild, and it is not listed in the CISA KEV catalog. However, because the flaw allows a local or remote administrator to elevate privileges during the user import flow, it can be leveraged by anyone who can execute import scripts or has access to the database configuration. The attack vector is indirect, requiring control over the agoraFields[] payload, but the impact is full administrative control.