Ecclesia Crm CVE-2026-6628

No vendor-released patch identified at time of analysis; the vendor did not respond to early disclosure. Immediate remediation requires network-level and application-level controls. First, restrict network access to the /v2/query/view/ endpoint using a Web Application Firewall or reverse proxy-only permit access from trusted administrative networks and block all external access if not essential. Second, implement strict input validation and parameterized queries at the application level if source code access is available, or request source code review from a security consultant. Third, rotate all database credentials and review user access logs for any suspicious query activity in database audit logs. Fourth, enforce strong authentication for all Ecclesia CRM user accounts and consider disabling or restricting the Query Viewer Component entirely if not actively used in production. Fifth, apply database-level SQL injection prevention: use database role separation (restrict the CRM database user to minimal necessary permissions), enable query logging, and use database activity monitoring. These controls do not eliminate the vulnerability but significantly reduce exploitability and limit lateral movement if compromise occurs.