SQL injection in Saltcorn mobile-sync endpoints (CVE-2026-41478)

A SQL injection vulnerability in Saltcorn's mobile-sync routes allows any authenticated low-privilege user with read access to at least one table to inject arbitrary SQL by supplying malicious values in sync parameters such as `maxLoadedId`, which are interpolated directly into SQL template literals without parameterization or sanitization. Successful exploitation can lead to full database exfiltration, including admin password hashes and configuration secrets, and may also permit database modification or destruction depending on the backend. Affected versions: - v1.4.5 We recommend updating to: 1.4.6, 1.5.6, 1.6.0-beta.5. CVSS 9.9 · our assessment: act_now Reference: https://github.com/saltcorn/saltcorn/security/advisories/GHSA-jp74-mfrx-3qvh Details: https://vuln.today/cve/CVE-2026-41478