CVE-2026-41478

Saltcorn: SQL Injection via Unparameterized Sync Endpoints (maxLoadedId)

CVSS 10 CRITICALEPSS 0.3%CWE-89

Vexday Risk Score

28Low

SSVC decision (CISA)

Track

No exploitation signal → monitor

CVSS 10EPSS 0.3%KEV nãoPoC —Nuclei —Metasploit —Patch —

Lifecycle

24 Apr 2026Published on NVD

Recommendation: Monitor — no exploitation signal at the moment.

Saltcorn is an extensible, open source, no-code database application builder. Prior to 1.4.6, 1.5.6, and 1.6.0-beta.5, a SQL injection vulnerability in Saltcorn’s mobile-sync routes allows any authenticated low-privilege user with read access to at least one table to inject arbitrary SQL through sync parameters. This can lead to full database exfiltration, including admin password hashes and configuration secrets, and may also enable database modification or destruction depending on the backend. This vulnerability is fixed in 1.4.6, 1.5.6, and 1.6.0-beta.5.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Affected products

saltcorn · saltcorn

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

https://github.com/saltcorn/saltcorn/security/advisories/GHSA-jp74-mfrx-3qvh