CVE-2026-41478 - Vulnerability Analysis

Overview

Saltcorn < 1.4.6, < 1.5.6, and < 1.6.0-beta.5 contains a SQL injection caused by improper sanitization in mobile-sync routes, letting authenticated low-privilege users with read access inject arbitrary SQL, potentially leading to full database compromise.

Severity & Score

Impact

Authenticated low-privilege users can exfiltrate or modify the entire database, including sensitive admin data and configuration secrets.

Mitigation

Upgrade to versions 1.4.6, 1.5.6, or 1.6.0-beta.5 or later.

References

• https://github.com/saltcorn/saltcorn/security/advisories/GHSA-jp74-mfrx-3qvh

Social Media Activity(1 post)

TheHackerWire

@thehackerwire

Apr 24, 2026

🔴 CVE-2026-41478 - Critical (9.9) Saltcorn is an extensible, open source, no-code database application builder. Prior to 1.4.6, 1.5.6, and 1.6.0-beta.5, a SQL injection vulnerability in Saltcorn’s mobile-sync routes allows any authenticated low-privilege user with read access to... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-41478/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner