CVE-2026-41460: SocialEngine SQL Injection in activity/index/get-memberall endpoint

Overview

SocialEngine versions 7.8.0 and prior are affected by an SQL injection weakness classified as CWE-89 in the /activity/index/get-memberall endpoint. The record states that the text parameter is incorporated into an SQL query without sanitization. VulnCheck, the CNA, rates the issue as critical.

Impact

• According to the record, an unauthenticated remote attacker could read arbitrary data from the database.
• The record states the flaw could be used to reset administrator account passwords.
• It could grant unauthorized access to the Packages Manager in the Admin Panel, which the record associates with potential remote code execution.
• The CVSS 3.1 base score is 9.8 (critical), with a vector indicating network access, low complexity, no privileges and no user interaction.

Affected products and versions

• Product: SocialEngine (listed in the record as Socialengine Socialengine).
• Range: 7.8.0 and prior, written in the record as up to and including 7.8.0.
• The record does not enumerate earlier releases individually, so the exact lower bound is unknown.

Exploitation status

• The CVE is not listed in CISA KEV in the record, so no confirmed active exploitation is attributed to it by that catalog.
• No confirmed exploitation appears in the sources consulted.
• The SSVC exploitation field is recorded as proof-of-concept and automatable is recorded as yes.
• The EPSS probability is 0.01014 with a percentile of 0.62942.
• The reference list includes an entry tagged as an exploit; its content was not analyzed for this summary.

Remediation and mitigation

• The record contains no fixed version. Check the vendor site at socialengine.com for an official update and treat every instance at 7.8.0 or earlier as exposed until a vendor fix is confirmed.
• Where feasible, restrict network access to the affected endpoint while a fix is pending. This is a general defensive measure, not a vendor recommendation.
• Review administrator accounts and recent password resets, rotate credentials where there is doubt, and audit changes made through the Packages Manager.
• Limit the database privileges of the web application account to what it strictly requires.

Detection guidance

• Review web server and application logs for requests to the affected endpoint that carry unusual or malformed values in the text parameter, and for database error messages returned to clients.
• Monitor for unexpected administrator password resets and for new or modified packages in the Admin Panel.
• Correlate these signals with authentication logs to identify any access that did not originate from known administrators.

Limitations of the available information

• No fixed version, patch details or vendor advisory are present in the record.
• The exact set of affected releases before 7.8.0 is not specified.
• Details come largely from third-party sources, including the VulnCheck advisory and Karma Insecurity KIS-2026-08.
• Whether the flaw has been used in real attacks is unknown beyond the sources consulted.

Frequently asked questions

Is this SocialEngine flaw being actively exploited?

It is not listed in CISA KEV in the record, and no confirmed exploitation appears in the sources consulted. The record does note an exploit-tagged reference and a proof-of-concept exploitation rating, so monitoring is advisable.

Which SocialEngine versions are affected?

The record lists SocialEngine 7.8.0 and prior, which is written as up to and including 7.8.0. It does not list a fixed version.

What should administrators do now?

Confirm whether you run 7.8.0 or earlier, check the vendor for an official update, limit exposure of the affected endpoint where feasible, and review administrator accounts and Packages Manager activity.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.