CVE-2026-63165 is a high severity (CVSS 8.1) SQL injection in the calendar module of Omnispace Agora Project before 26.10.0. The sortEvents parameter is added to an ORDER BY clause without sanitising, so logged in users can read database contents. Upgrade to the current 26.10 release.
What's affected
The record says Omnispace Agora Project before 26.10.0. The weakness is CWE-89 (SQL injection). The unsafe code is in app/ModCalendar/CtrlCalendar.php, where the sortEvents value is joined into the ORDER BY clause of a query.
The vector is network based, low complexity, low privileges and no user interaction, with high confidentiality and integrity impact. A logged in user can send the request, so any account on the system counts, not only administrators. The record says database information can be extracted, including the version.
Source note. The release page for 26.10 (the latest listed is 26.10.2) describes feature changes and does not mention security fixes, so the fixed version comes from the record, which says before 26.10.0. Upgrade to the current 26.10 release and confirm the change log for your build.
How to check if you're exposed
Check which release is installed and whether the calendar module is enabled.
grep -rn "sortEvents" /path/to/agora/app/ModCalendar/ 2>/dev/null
If the unsanitised use of sortEvents is still present in your copy, the code has not been updated. Also review web server logs for calendar requests with unusual sortEvents values, and for database errors returned to clients.
Whatever the product, a current inventory of what you run is what turns a CVE notice into a quick answer. The Gold page for this CVE tracks how its record changes over time, and the free in-browser dependency scan at gold.safeguard.sh/scan covers the application libraries you ship.
What to do now
- Upgrade to the current 26.10 release.
- Check calendar related requests in your access logs for strange sortEvents values since you installed an affected version.
- Restrict the database account used by the application to the rights it needs.
- Disable detailed database error output in production settings.
- Consider a web application firewall rule as a stopgap. It does not replace the patch.
Why it matters
ORDER BY clauses are a common SQL injection blind spot. Placeholders in prepared statements protect values, but not column names or sort directions, so developers who parameterise everything else may still build this part with string joins. The safe pattern is an allow list of sort columns that the code maps to fixed text.
The class is CWE-89. The record does not mark this CVE as exploited in the wild.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Why do prepared statements not stop this?
Placeholders carry values, not SQL keywords or column names. A sort parameter has to be checked against a fixed list in the code.
Sources
Last reviewed: 18 October 2026.
