The vulnerability exists in the /api/v2?cmd=get_home_stats endpoint of Tautulli. Unsanitised query parameters (section_id, user_id, before, after) are inserted directly into SQL statements using Python string formatting, enabling attackers who possess an administrative API key to inject arbitrary SQL. The injection can be leveraged for boolean‑blind inference, allowing the attacker to read any value from the Tautulli SQLite database, compromising data confidentiality.

Tautulli versions from 2.14.2 up to (but not including) 2.17.0 are affected for the before/after parameters, while versions from 2.1.0‑beta up to 2.17.0 are affected for section_id and user_id. Users running any of these builds with the vulnerable API endpoint enabled and an administrator API key are exposed to this flaw.

The CVSS base score of 4.9 indicates a moderate impact. The EPSS score is reported as less than 1 percent, suggesting a low probability of exploitation in the wild, and the flaw is not yet listed in the CISA KEV catalog. Exploitation requires the attacker to know or acquire the Tautulli admin API key, then craft a malicious request to the vulnerable endpoint; however, once the patch is applied, the issue is resolved.