Omnispace Agora Project versions earlier than 26.10.0 store unsanitized link addresses in a field that is later inserted into an onclick handler. An authenticated user can place a malicious script in that field, which is then displayed in the browser of any user who views the links list, allowing the attacker to hijack session cookies or otherwise compromise the victim’s client.

The vulnerability affects the Omnispace Agora Project running any version prior to 26.10.0.

The CVSS base score of 5.1 indicates a moderate impact, and the EPSS score of less than 1% suggests a very low likelihood of exploitation in the wild. However, because the flaw requires authenticated access, potential attackers within the organization or those able to create an account could use the Links module to inject scripts that execute for other users, enabling session hijacking or client‑side compromise. The flaw is not yet listed in CISA’s KEV catalog.