GYM One CVE-2026-55871

Requires an authenticated administrator session (PR:H) on a GYM One instance prior to version 1.4.1; the injection is reached specifically through the search_name or search_email GET parameters on admin/users/index.php, which are concatenated into the user-listing and pagination COUNT queries without prepared statements. Confidentiality impact (reading arbitrary tables including password hashes) applies unconditionally once that admin access exists. The additional filesystem-write capability is a further-limited condition that only applies when the underlying database account has sufficient privileges (e.g. the MySQL FILE privilege). The primary limiting factor is the admin-level authentication requirement, which narrows the realistic attacker population to insiders or those who have already compromised an admin account.

All provided signals point to a moderate, access-gated risk rather than an urgent, broadly-exploitable priority. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N, base 6.5) is network-reachable and low-complexity but explicitly requires high privileges (PR:H), which the description confirms as an authenticated administrator - so an attacker must already hold the highest application role before the flaw is reachable. No EPSS probability, no CISA KEV entry, and no public POC were provided in the input, so exploitation status is 'no public exploit identified at time of analysis'; there is also no SSVC decision block to evaluate. The signals are internally consistent (CVSS PR:H aligns with the 'authenticated administrator' description), so there is no network-vs-local or authentication conflict to flag. In practice this is a classic post-authentication SQL injection whose impact is bounded by trust already granted to an admin account; its value to an attacker is privilege/scope leverage (dumping password hashes for credential reuse, and conditional filesystem writes) rather than initial access. Net assessment: genuine but not high-urgency - worth patching promptly in multi-admin or hardened deployments where admin accounts are not fully trusted, but not a mass-exploitation candidate.

An attacker holding (or abusing) an administrator session browses to admin/users/index.php and supplies a crafted search_name or search_email GET parameter containing SQL syntax. Because the parameter is concatenated into both the user-list query and the pagination COUNT query without prepared statements, the attacker extracts arbitrary table data such as user records and password hashes, and where the database account holds FILE/write privileges may write a file to disk. No public exploit code was identified in the provided data, though the injection is straightforward for anyone with admin access.