Omnispace Agora Project versions prior to 26.10.0 contain a SQL injection flaw in the calendar feature. The flaw stems from concatenating the user‑supplied sortEvents parameter directly into an ORDER BY clause. An attacker can inject arbitrary SQL expressions, such as extractvalue statements, to read sensitive database information including version data. This impacts confidentiality by allowing data extraction and may also allow integrity impact if the attacker can modify queries to inject malicious statements. The flaw is identified as CWE‑89.

The vulnerability affects the Omnispace Agora Project. All releases dated before 26.10.0 are affected. No specific sub‑versions are listed, so any version lower than 26.10.0 should be considered vulnerable.

The CVSS v3 score of 8.6 indicates a high risk. The EPSS score is below 1 %, suggesting a low exploitation probability in the current environment, but the flaw is highly impactful. The vulnerability is not listed in CISA KEV, indicating no known public exploit. Attackers can exploit this via HTTP requests to the application’s calendar endpoint by manipulating the sortEvents parameter, provided they have network access to the web service and can submit crafted input.