CVE-2026-41478: Saltcorn: SQL Injection via Unparameterized Mobile Sync Endpoints (maxLoadedId)
Saltcorn, a no-code database application builder, has an SQL injection flaw in its mobile-sync routes. Any authenticated user with low privileges and read access to at least one table can inject SQL through sync parameters, which the advisory says could expose the whole database, including admin password hashes and configuration secrets, and could also allow modification or destruction depending on the backend. The record states the issue is fixed in 1.4.6, 1.5.6 and 1.6.0-beta.5.
Overview
Saltcorn is an extensible, open source, no-code database application builder. The GitHub advisory GHSA-jp74-mfrx-3qvh describes an SQL injection (CWE-89) in the mobile-sync routes, where sync parameters are used in SQL without parameterization.
Impact
- The advisory states that an authenticated low-privilege user with read access to at least one table can inject arbitrary SQL.
- It states this may lead to full database exfiltration, including admin password hashes and configuration secrets.
- It states it may also enable database modification or destruction, depending on the backend.
Affected products and versions
- Product: Saltcorn Saltcorn.
- Per the description, vulnerable versions are those before 1.4.6, from 1.5.0-beta.0 up to before 1.5.6, and from 1.6.0-alpha.0 up to before 1.6.0-beta.5.
- The record lists many individual pre-release builds of the 1.6.0 line; these appear to fall within the range from 1.6.0-alpha.0 up to before 1.6.0-beta.5.
Exploitation status
The CISA KEV catalog entry in the record is not listed. No confirmed exploitation appears in the sources consulted. The record's SSVC data lists exploitation as proof-of-concept (poc) and automatable as no.
Remediation and mitigation
- Upgrade to a fixed release on the affected line: 1.4.6, 1.5.6, or 1.6.0-beta.5, as stated in the description.
- Until patched, limit which accounts have read access to tables, and review low-privilege accounts for unnecessary access.
- If exposure is suspected, review administrator and configuration secrets and rotate them according to your internal policy.
Detection guidance
- Review application and database logs for mobile-sync requests with unusual or malformed parameter values.
- Look for unexpected database reads of sensitive tables, or unexpected schema or data changes, from application accounts.
Limitations of the available information
- The record's fixes list is empty; fixed versions are taken from the description and the advisory reference.
- CVSS scores differ between sources: 10 from GitHub_M and 9.9 from the security-advisories provider, both version 3.1.
- No technical details, proof-of-concept code or affected backend specifics are provided in the record, so impact per backend is unknown.
Frequently asked questions
Which Saltcorn versions are fixed for CVE-2026-41478?
According to the record's description, the issue is fixed in 1.4.6, 1.5.6 and 1.6.0-beta.5. The record's fixes list is empty, so check the vendor advisory for details.
Does this CVE require high privileges to exploit?
No. The description says any authenticated user with low privileges and read access to at least one table is in scope, consistent with the CVSS vector PR:L.
Is this CVE known to be actively exploited?
The record shows it is not listed in CISA KEV, and no confirmed exploitation appears in the sources consulted.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.