Saltcorn’s mobile‑sync endpoints allow an authenticated user with read access to any table to inject arbitrary SQL through unparameterized sync parameters. This constitutes a classic SQL injection (CWE‑89) that can result in full extraction of the database, including administrative password hashes and configuration secrets, and may also allow modification or destruction of the database depending on the backend. The vulnerability requires only low‑privilege read access, making it broadly exploitable by users who should not have the ability to alter or read beyond their table data.

The vulnerability exists in Saltcorn versions earlier than 1.4.6, 1.5.6, and 1.6.0‑beta.5. Users running these release lines are affected; upgrading to the specified versions disables the flaw.

The CVSS score is 10, indicating extreme severity, but the EPSS score is less than 1%, showing a very low probability of exploitation at present. The flaw is not catalogued in CISA KEV. Exploitation requires authenticated access to the sync endpoints, so the attack vector is likely internal or routed through an authenticated session. The high severity coupled with low EPSS suggests that while the vulnerability is critical, it is not widely or imminently exploited.