Ory Kratos exposes a SQL injection flaw in its ListCourierMessages Admin API before version 26.2.0. Pagination tokens are encrypted with a secret; if an attacker knows that secret or if the system uses the publicly known default, they can construct malicious tokens that cause the backend to execute arbitrary SQL statements, potentially compromising data integrity or confidentiality.

Any installation of Ory Kratos running a version earlier than 26.2.0 without a custom pagination secret is vulnerable. The vulnerability applies to the ListCourierMessages API endpoint in the identity management service.

The CVSS score of 7.2 indicates a medium‑to‑high severity. While EPSS data is not available, the attack requires knowledge of the pagination secret or reliance on the default known value, making exploitation more difficult but still feasible. The vulnerability is not listed in the CISA KEV catalog, yet the potential for data compromise warrants immediate attention.