ApiAdmin CVE-2026-88397

Requires a low-privilege authenticated session to the ApiAdmin administrative area (PR:L), with the ability to reach the user-list endpoint GET /admin/User/getUsers and supply attacker-controlled input in the gid parameter. No user interaction and no special non-default feature is required beyond the endpoint being reachable. The principal limiting factor is the authentication prerequisite - an unauthenticated outsider cannot directly trigger it - which meaningfully reduces real-world exposure compared to an unauthenticated injection; impact is further bounded to data disclosure (no integrity or availability impact).

This is a medium-severity SQL injection (CWE-89) with a moderate, well-corroborated risk profile. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N) describes a network-reachable, low-complexity attack that nonetheless requires low-privilege authentication (PR:L), and impact is limited to confidentiality (C:H/I:N/A:N) - consistent with data exfiltration via injection rather than full system compromise. Signals are largely in agreement rather than conflicting: EPSS is very low (0.15%, 4th percentile) and SSVC rates it Automatable:no with Technical Impact:partial, indicating no evidence of mass/wormable exploitation. SSVC does record Exploitation:poc and a public write-up exists on GitHub, so publicly available exploit code exists, but this is NOT in CISA KEV and there is no confirmed active exploitation - POC availability and active exploitation are distinct signals. The low-partial automatability combined with the PR:L authentication requirement and a niche affected product means this is a legitimate but not high-urgency issue: prioritize patching for anyone running ApiAdmin, but it does not rise to emergency 'exploited-in-the-wild' status. Note the input CPE ('cpe:2.3:a:n/a:n/a:*') and EUVD affected version ('n/a n/a') are placeholder/unpopulated values, so exact affected-version boundaries beyond 'v5.0 and before' are not independently confirmed.

An attacker who holds (or obtains) a low-privilege authenticated session on an ApiAdmin 5.0 (or earlier) instance sends a crafted value in the gid parameter to GET /admin/User/getUsers, injecting SQL that the backend executes against the database. Because impact is confidentiality-only, the attacker reads out user records and other database contents such as credentials or session data. A public proof-of-concept write-up exists on GitHub, lowering the effort required to reproduce the attack.