The vulnerability is a classic SQL injection that occurs in the Notes controller’s accessing_dictionary_authorization function when the Password parameter is concatenated directly into a SQL query without any sanitization. An attacker able to influence this value can trigger arbitrary SQL commands, enabling the disclosure, modification, or deletion of database contents. The weakness is identified as CWE‑74 and CWE‑89 and would fully compromise the confidentiality, integrity, and availability of the application’s stored data.

Instances of the Stumasy application built from mjperpinosa’s code where the accessing_dictionary_authorization function still processes the Password argument unsafely are affected. Because the project follows a rolling‑release model and does not publish discrete version numbers, the exact state is determined by the committed code; any deployment that has not incorporated a fix (i.e., has not removed the insecure string concatenation) remains vulnerable.

The CVSS score of 6.9 places this as a medium‑severity flaw. The EPSS score of less than 1% suggests a low probability of exploitation in the wild, but a publicly available exploit is already circulating and can be launched from any remote host. The vulnerability is not listed in the CISA KEV catalog; however, the remote attack surface and the existence of an exploit emphasize the need for prompt mitigation.