CVE-2026-14750: SQL Injection in mjperpinosa stumasy Notes Controller

Technical summary

CVE-2026-14750 is a SQL injection vulnerability (CWE-89) resulting from improper neutralization of special elements in data (CWE-74) within the Notes_controller::accessing_dictionary_authorization function located in application/PHP/objects/notes/accessing_dictionary_authorization.php. The Password parameter fails to properly sanitize user input before constructing database queries. The vulnerability has a CVSS 3.1 score of 7.3 (HIGH) with a network-based attack vector, low complexity, no privilege requirements, and no user interaction needed. Impact is classified as limited confidentiality, integrity, and availability compromise.

Business impact

Exploitation could allow threat actors to exfiltrate sensitive data stored in the application's database, modify or delete records, and potentially escalate privileges within the system. For organizations deploying stumasy, this represents a direct path to unauthorized data access and manipulation without requiring valid credentials. The public availability of exploit code elevates the practical risk significantly, as opportunistic attackers can attempt exploitation at scale. Data breach costs, regulatory penalties under privacy frameworks, and operational disruption are material business concerns.

Affected systems

mjperpinosa stumasy up to commit 327d1b0f2915ba79d7ef8ebb74553e987609d9be is affected. The project employs a rolling release model, so traditional version numbering is not published. Organizations should identify internal deployments by commit hash or build date and verify patch status directly with the project's repository or advisories. Any instance of the application running the vulnerable Notes controller function is at risk.

Exploitability

This vulnerability is highly exploitable. It requires only a network connection and no credentials or user interaction; an attacker can craft HTTP requests containing malicious SQL payloads in the Password parameter to trigger injection. Proof-of-concept code is publicly available, significantly lowering the barrier to entry for both sophisticated attackers and opportunistic threat actors. The attack is consistent and reliable across vulnerable instances.

Remediation

The project maintainers must implement parameterized queries or prepared statements for the Password parameter in the accessing_dictionary_authorization function, ensuring all user input is treated as data rather than executable SQL. Input validation and output encoding should reinforce this defense. Organizations deploying stumasy should monitor the project's repository for patches, review commit history for security fixes, and test updates in non-production environments before deployment. Given the rolling release model, continuous monitoring of upstream changes is essential.

Patch guidance

Because stumasy uses continuous rolling releases without discrete version numbers, patches are not released as traditional software versions. Organizations should monitor the project's version control system (likely Git) for commits addressing SQL injection in the Notes controller. After identifying and applying upstream fixes, conduct thorough testing to confirm the Password parameter is properly sanitized and SQL injection attempts are neutralized. Verify that the specific commit resolving CVE-2026-14750 has been integrated into your deployed instances.

Detection guidance

Monitor application logs and database query logs for anomalous SQL patterns in the Notes_controller::accessing_dictionary_authorization function, particularly around the Password parameter. Look for SQL syntax fragments, UNION-based injection attempts, time-based blind injection indicators, or unusual database errors. Web application firewalls (WAF) should be configured to detect common SQL injection signatures in POST/GET parameters. Intrusion detection systems should flag requests containing SQL metacharacters or encoded payloads targeting this endpoint. Conduct periodic code reviews of the affected file to ensure no new injection points have been introduced.

Why prioritize this

This vulnerability merits immediate attention due to its high CVSS score (7.3), remote exploitability without authentication, and public exploit availability. The lack of vendor response compounds risk, as defenders cannot rely on official guidance or timelines. Organizations must assume active exploitation is likely and prioritize either patching, compensating controls, or system isolation based on their asset criticality and threat model.

Risk score, explained

The CVSS 3.1 score of 7.3 reflects the severity: network-accessible attack vector with low complexity, no privileges required, and no user interaction. The impact spans confidentiality (data disclosure), integrity (data modification), and availability (denial of service via resource exhaustion or database corruption). The score does not account for environmental factors such as public exploit availability or vendor non-response, which stakeholders should consider when determining actual organizational risk. Internal risk scoring should factor in asset exposure, data sensitivity, and threat intelligence indicating active exploitation.

Frequently asked questions