CVE-2026-41478

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-41478", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-04-20T16:14:19.005Z", "datePublished": "2026-04-24T20:52:30.670Z", "dateUpdated": "2026-04-27T13:34:34.775Z"}, "containers": {"cna": {"title": "Saltcorn: SQL Injection via Unparameterized Sync Endpoints (maxLoadedId)", "problemTypes": [{"descriptions": [{"cweId": "CWE-89", "lang": "en", "description": "CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 10, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/saltcorn/saltcorn/security/advisories/GHSA-jp74-mfrx-3qvh", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/saltcorn/saltcorn/security/advisories/GHSA-jp74-mfrx-3qvh"}], "affected": [{"vendor": "saltcorn", "product": "saltcorn", "versions": [{"version": "< 1.4.6", "status": "affected"}, {"version": ">= 1.5.0-beta.0, < 1.5.6", "status": "affected"}, {"version": ">= 1.6.0-alpha.0, < 1.6.0-beta.5", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-24T20:52:30.670Z"}, "descriptions": [{"lang": "en", "value": "Saltcorn is an extensible, open source, no-code database application builder. Prior to 1.4.6, 1.5.6, and 1.6.0-beta.5, a SQL injection vulnerability in Saltcorn\u2019s mobile-sync routes allows any authenticated low-privilege user with read access to at least one table to inject arbitrary SQL through sync parameters. This can lead to full database exfiltration, including admin password hashes and configuration secrets, and may also enable database modification or destruction depending on the backend. This vulnerability is fixed in 1.4.6, 1.5.6, and 1.6.0-beta.5."}], "source": {"advisory": "GHSA-jp74-mfrx-3qvh", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/saltcorn/saltcorn/security/advisories/GHSA-jp74-mfrx-3qvh", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-27T13:10:53.061661Z", "id": "CVE-2026-41478", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-27T13:34:34.775Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-41478", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-04-27T13:10:53.061661Z"}}}], "references": [{"url": "https://github.com/saltcorn/saltcorn/security/advisories/GHSA-jp74-mfrx-3qvh", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-27T13:10:54.104Z"}}], "cna": {"title": "Saltcorn: SQL Injection via Unparameterized Sync Endpoints (maxLoadedId)", "source": {"advisory": "GHSA-jp74-mfrx-3qvh", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 10, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "saltcorn", "product": "saltcorn", "versions": [{"status": "affected", "version": "< 1.4.6"}, {"status": "affected", "version": ">= 1.5.0-beta.0, < 1.5.6"}, {"status": "affected", "version": ">= 1.6.0-alpha.0, < 1.6.0-beta.5"}]}], "references": [{"url": "https://github.com/saltcorn/saltcorn/security/advisories/GHSA-jp74-mfrx-3qvh", "name": "https://github.com/saltcorn/saltcorn/security/advisories/GHSA-jp74-mfrx-3qvh", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "Saltcorn is an extensible, open source, no-code database application builder. Prior to 1.4.6, 1.5.6, and 1.6.0-beta.5, a SQL injection vulnerability in Saltcorn\u2019s mobile-sync routes allows any authenticated low-privilege user with read access to at least one table to inject arbitrary SQL through sync parameters. This can lead to full database exfiltration, including admin password hashes and configuration secrets, and may also enable database modification or destruction depending on the backend. This vulnerability is fixed in 1.4.6, 1.5.6, and 1.6.0-beta.5."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-89", "description": "CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-24T20:52:30.670Z"}}}, "cveMetadata": {"cveId": "CVE-2026-41478", "state": "PUBLISHED", "dateUpdated": "2026-04-27T13:34:34.775Z", "dateReserved": "2026-04-20T16:14:19.005Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-04-24T20:52:30.670Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "saltcorn", "vendor": "saltcorn", "versions": [{"status": "affected", "version": "< 1.4.6"}, {"status": "affected", "version": ">= 1.5.0-beta.0, < 1.5.6"}, {"status": "affected", "version": ">= 1.6.0-alpha.0, < 1.6.0-beta.5"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:saltcorn:saltcorn:*:*:*:*:*:*:*:*", "matchCriteriaId": "08967BF9-FA6A-4810-8533-60AE07024CB2", "versionEndExcluding": "1.4.6", "vulnerable": true}, {"criteria": "cpe:2.3:a:saltcorn:saltcorn:*:*:*:*:*:*:*:*", "matchCriteriaId": "102B07EA-0948-4E2F-8737-C14A2EDEF7E0", "versionEndExcluding": "1.5.6", "versionStartIncluding": "1.5.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:saltcorn:saltcorn:1.6.0:alpha0:*:*:*:*:*:*", "matchCriteriaId": "B9F0B1DA-694D-46DC-B1C3-B013AC4A849C", "vulnerable": true}, {"criteria": "cpe:2.3:a:saltcorn:saltcorn:1.6.0:alpha1:*:*:*:*:*:*", "matchCriteriaId": "5A1F05CD-57F4-419B-ACA8-D7C9B6368863", "vulnerable": true}, {"criteria": "cpe:2.3:a:saltcorn:saltcorn:1.6.0:alpha10:*:*:*:*:*:*", "matchCriteriaId": "EBF44DCF-6989-4E65-97D0-7C8A9260189A", "vulnerable": true}, {"criteria": "cpe:2.3:a:saltcorn:saltcorn:1.6.0:alpha11:*:*:*:*:*:*", "matchCriteriaId": "E6666919-896F-4D1D-8225-3E91BAC9F101", "vulnerable": true}, {"criteria": "cpe:2.3:a:saltcorn:saltcorn:1.6.0:alpha12:*:*:*:*:*:*", "matchCriteriaId": "B1724AAF-1FDA-402D-94D2-86CF9DD8839C", "vulnerable": true}, {"criteria": "cpe:2.3:a:saltcorn:saltcorn:1.6.0:alpha13:*:*:*:*:*:*", "matchCriteriaId": "696855BA-6E8A-4170-8CC9-8C267C85397B", "vulnerable": true}, {"criteria": "cpe:2.3:a:saltcorn:saltcorn:1.6.0:alpha14:*:*:*:*:*:*", "matchCriteriaId": "8B954E3D-95F4-49FB-8A3A-1DFAE831EAEE", "vulnerable": true}, {"criteria": "cpe:2.3:a:saltcorn:saltcorn:1.6.0:alpha15:*:*:*:*:*:*", "matchCriteriaId": "E0EEE350-1436-4C28-B0D7-B2EC26CEF65C", "vulnerable": true}, {"criteria": "cpe:2.3:a:saltcorn:saltcorn:1.6.0:alpha16:*:*:*:*:*:*", "matchCriteriaId": "DD555EEB-8C7B-4519-8037-3F4E8CDFFA51", "vulnerable": true}, {"criteria": "cpe:2.3:a:saltcorn:saltcorn:1.6.0:alpha17:*:*:*:*:*:*", "matchCriteriaId": "12C8A9DD-0E70-4BD2-A0DF-8951757200DA", "vulnerable": true}, {"criteria": "cpe:2.3:a:saltcorn:saltcorn:1.6.0:alpha2:*:*:*:*:*:*", "matchCriteriaId": "E8F83440-DA15-4415-B29F-4710021E06A8", "vulnerable": true}, {"criteria": "cpe:2.3:a:saltcorn:saltcorn:1.6.0:alpha3:*:*:*:*:*:*", "matchCriteriaId": "0276E1CB-EFFA-47DF-A281-3317F9EA566E", "vulnerable": true}, {"criteria": "cpe:2.3:a:saltcorn:saltcorn:1.6.0:alpha4:*:*:*:*:*:*", "matchCriteriaId": "399C6A3D-4EC0-498A-98E6-A81E581E8A10", "vulnerable": true}, {"criteria": "cpe:2.3:a:saltcorn:saltcorn:1.6.0:alpha5:*:*:*:*:*:*", "matchCriteriaId": "9A768259-04EC-4EA7-83E6-F802A43F7F12", "vulnerable": true}, {"criteria": "cpe:2.3:a:saltcorn:saltcorn:1.6.0:alpha6:*:*:*:*:*:*", "matchCriteriaId": "9E0E2D7E-96AA-427A-9043-460C8D6C718E", "vulnerable": true}, {"criteria": "cpe:2.3:a:saltcorn:saltcorn:1.6.0:alpha7:*:*:*:*:*:*", "matchCriteriaId": "22CA8D18-519C-4DA9-B245-2E2BA6651ED7", "vulnerable": true}, {"criteria": "cpe:2.3:a:saltcorn:saltcorn:1.6.0:alpha8:*:*:*:*:*:*", "matchCriteriaId": "E2820DF8-8124-4880-86F4-A262E5E884AB", "vulnerable": true}, {"criteria": "cpe:2.3:a:saltcorn:saltcorn:1.6.0:alpha9:*:*:*:*:*:*", "matchCriteriaId": "2A3A7215-0C13-4611-8846-804853DAA0B0", "vulnerable": true}, {"criteria": "cpe:2.3:a:saltcorn:saltcorn:1.6.0:beta1:*:*:*:*:*:*", "matchCriteriaId": "480F4CEF-4019-41AC-AD7B-8D317619132A", "vulnerable": true}, {"criteria": "cpe:2.3:a:saltcorn:saltcorn:1.6.0:beta2:*:*:*:*:*:*", "matchCriteriaId": "CB023AEF-5AEF-4923-9552-028BF47D7119", "vulnerable": true}, {"criteria": "cpe:2.3:a:saltcorn:saltcorn:1.6.0:beta3:*:*:*:*:*:*", "matchCriteriaId": "959C8B5C-080D-48AA-A91A-AC3F50128450", "vulnerable": true}, {"criteria": "cpe:2.3:a:saltcorn:saltcorn:1.6.0:beta4:*:*:*:*:*:*", "matchCriteriaId": "900BADC0-641F-4854-921B-310C213A1FE9", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Saltcorn is an extensible, open source, no-code database application builder. Prior to 1.4.6, 1.5.6, and 1.6.0-beta.5, a SQL injection vulnerability in Saltcorn\u2019s mobile-sync routes allows any authenticated low-privilege user with read access to at least one table to inject arbitrary SQL through sync parameters. This can lead to full database exfiltration, including admin password hashes and configuration secrets, and may also enable database modification or destruction depending on the backend. This vulnerability is fixed in 1.4.6, 1.5.6, and 1.6.0-beta.5."}, {"lang": "es", "value": "Saltcorn es un constructor de aplicaciones de base de datos sin c\u00f3digo, de c\u00f3digo abierto y extensible. Antes de 1.4.6, 1.5.6 y 1.6.0-beta.5, una vulnerabilidad de inyecci\u00f3n SQL en las rutas de sincronizaci\u00f3n m\u00f3vil de Saltcorn permite a cualquier usuario autenticado con bajos privilegios y acceso de lectura a al menos una tabla inyectar SQL arbitrario a trav\u00e9s de par\u00e1metros de sincronizaci\u00f3n. Esto puede llevar a la exfiltraci\u00f3n completa de la base de datos, incluyendo hashes de contrase\u00f1as de administrador y secretos de configuraci\u00f3n, y tambi\u00e9n puede permitir la modificaci\u00f3n o destrucci\u00f3n de la base de datos dependiendo del backend. Esta vulnerabilidad est\u00e1 corregida en 1.4.6, 1.5.6 y 1.6.0-beta.5."}], "id": "CVE-2026-41478", "lastModified": "2026-11-11T23:10:00.263", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.9, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 6.0, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-41478", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-04-27T13:10:53.061661Z", "version": "2.0.3"}}]}, "published": "2026-04-24T21:16:19.353", "references": [{"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/saltcorn/saltcorn/security/advisories/GHSA-jp74-mfrx-3qvh"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Vendor Advisory"], "url": "https://github.com/saltcorn/saltcorn/security/advisories/GHSA-jp74-mfrx-3qvh"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-89"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.4.6)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[1.5.0-beta.0,1.5.6)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[1.6.0-alpha.0,1.6.0-beta.5)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "saltcorn", "source": "cna", "vendor": "saltcorn"}, "product": "saltcorn", "vendor": "saltcorn"}], "analysis": {"en": {"generated_at": "2026-04-28T05:44:24.172323+00:00", "value": {"mitigation_remediation": ["Apply the latest Saltcorn release (1.4.6, 1.5.6, or 1.6.0\u2011beta.5) to remove the unparameterized sync endpoints.", "If an upgrade is not immediately feasible, restrict or disable the sync endpoints for low\u2011privilege users, ensuring only administrators can access them.", "Actively monitor application logs for signs of SQL injection attempts and enforce strict access controls on tables that are exposed to sync mechanisms."], "summary": {"action": "Immediate Patch", "impact": "SQL Injection leading to database access"}, "threat_synthesis": {"affected_systems": "The vulnerability exists in Saltcorn versions earlier than 1.4.6, 1.5.6, and 1.6.0\u2011beta.5. Users running these release lines are affected; upgrading to the specified versions disables the flaw.", "description_and_impact": "Saltcorn\u2019s mobile\u2011sync endpoints allow an authenticated user with read access to any table to inject arbitrary SQL through unparameterized sync parameters. This constitutes a classic SQL injection (CWE\u201189) that can result in full extraction of the database, including administrative password hashes and configuration secrets, and may also allow modification or destruction of the database depending on the backend. The vulnerability requires only low\u2011privilege read access, making it broadly exploitable by users who should not have the ability to alter or read beyond their table data.", "risk_and_exploitability": "The CVSS score is 10, indicating extreme severity, but the EPSS score is less than 1%, showing a very low probability of exploitation at present. The flaw is not catalogued in CISA KEV. Exploitation requires authenticated access to the sync endpoints, so the attack vector is likely internal or routed through an authenticated session. The high severity coupled with low EPSS suggests that while the vulnerability is critical, it is not widely or imminently exploited."}}}}, "created": "2026-04-27T20:15:12.103548+00:00", "updated": "2026-04-28T05:45:23.303809+00:00", "vendors": ["saltcorn", "saltcorn$PRODUCT$saltcorn"]}