Tautulli CVE-2026-31799

CVSS 4.9 (High) with CVSS vector AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N indicates network-accessible SQL injection requiring high-privilege authentication (PR:H = admin API key required). EPSS exploitation probability data is not provided, but the practical risk is bounded by the authentication gate: an attacker must already possess the admin API key, significantly limiting the threat surface compared to unauthenticated SQL injection. The impact is confidentiality-only (C:H); no data modification or availability impact is possible via this vector. Real-world risk is moderate for organizations that (1) expose Tautulli to untrusted networks and (2) have compromised or leaked admin API keys. For isolated home-lab deployments, risk is minimal. The boolean-blind technique adds exploitation complexity but is not a barrier to determined attackers. This is a genuine vulnerability requiring patching, but lower priority than unauthenticated SQL injection flaws.

An attacker with access to a compromised or leaked Tautulli admin API key sends a crafted HTTP request to the /api/v2?cmd=get_home_stats endpoint, embedding SQL injection payloads in the section_id or user_id parameter (e.g., section_id=1 UNION SELECT password FROM users). Using boolean-blind inference (time delays or conditional logic), the attacker exfiltrates sensitive data such as user credentials, configuration settings, or Plex authentication tokens stored in the Tautulli SQLite database. No public exploit code is documented, but the attack requires only HTTP client tooling and knowledge of SQL injection techniques; exploitation is straightforward once authenticated.