CVE-2026-51946: SQL Injection in GoAdmin – CVSS 6.5 Remote Code & Data Risk

Technical summary

CVE-2026-51946 is a SQL injection vulnerability (CWE-89) in GoAdminGroup GoAdmin that exists across all /admin/info/{table} endpoints. The __sort_type URL parameter is not properly sanitized before being incorporated into SQL queries. An unauthenticated remote attacker can craft malicious payloads in this parameter to execute arbitrary SQL commands against the underlying database. The CVSS 3.1 score of 6.5 (MEDIUM) reflects network-accessible exploitation with low complexity, resulting in confidentiality and integrity impact but no availability impact.

Business impact

Organizations running GoAdmin for administrative dashboards face unauthorized data disclosure and potential data modification without requiring valid credentials. Attackers could extract sensitive application data, user information, or configuration details stored in the database. While the vulnerability does not directly cause denial of service, unauthorized data manipulation could corrupt application state and undermine data integrity assurance.

Affected systems

GoAdminGroup GoAdmin versions through v1.2.26 are affected. The vulnerability is present in all /admin/info/{table} endpoints, making any instance exposing these admin paths a potential target. Organizations should inventory deployments and verify the installed version against their patch timeline.

Exploitability

Exploitation requires only network access and basic HTTP crafting—no authentication, user interaction, or special configurations are needed. The attack surface is broad since the affected endpoints likely exist in default installations. However, the vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, suggesting active in-the-wild exploitation has not yet been documented at scale.

Remediation

Upgrade to a patched version of GoAdmin released after v1.2.26. Verify the specific patch version from the GoAdminGroup security advisory or GitHub releases. As an interim measure, implement network access controls restricting access to /admin/info/* endpoints to trusted IP ranges, and consider disabling admin endpoints if not actively in use.

Patch guidance

Check the official GoAdminGroup GitHub repository and security advisories for the patched release version. Apply the update during a maintenance window after testing in a non-production environment. Confirm that the __sort_type parameter is properly parameterized and escapes special characters in the patched version before deploying to production.

Detection guidance

Monitor HTTP logs for requests to /admin/info/{table} endpoints containing suspicious __sort_type parameter values, such as SQL keywords (SELECT, UNION, OR), quote characters, or comment sequences (-- or /**/). Implement Web Application Firewall (WAF) rules to block requests with SQL metacharacters in this parameter. Enable database query logging to detect execution of unexpected SQL patterns originating from the application.

Why prioritize this

Although assigned MEDIUM severity, this vulnerability warrants prompt attention due to its unauthenticated, network-accessible nature and direct impact on data confidentiality and integrity. Organizations relying on GoAdmin for sensitive administrative functions should prioritize patching. The lack of KEV status does not diminish the risk—it reflects current threat intelligence rather than technical severity.

Risk score, explained

The CVSS 3.1 score of 6.5 reflects a network-based attack with low complexity and no authentication required (AV:N, AC:L, PR:N, UI:N). Confidentiality and integrity are impacted (C:L, I:L), but availability is not affected (A:N). The score aligns with the practical risk: SQL injection is a well-understood and reliable attack vector, but the lack of availability impact and the requirement for some attacker knowledge prevents a higher rating.

Frequently asked questions