Coturn’s HTTPS admin panel contains an SQL injection flaw in its delete‑user, delete‑secret, and delete‑IP endpoints. The du, ds, and dip query parameters are directly interpolated into SQL statements without sanitization, allowing an authenticated administrator to inject arbitrary SQL attacker full control of the underlying database, and with PostgreSQL COPY TO PROGRAM the compromise could be escalated to operating‑system levelCWE‑89) that enables confidentiality and integrity compromise of the database and its data.

All installations of Coturn before version 4.12.0 are affected. Users running coturn releases lower than 4.12.0 on any platform that expose the HTTPS admin interface should consider themselves vulnerable. The fix is provided in the 4.12.0 release, so upgrading or re‑installing Coturn with that version resolves the issue.

The CVSS score of 7.2 denotes a high severity vulnerability. Exploitation requires authenticated access to the admin interface, limiting the threat to administrators or those who have compromised them. The EPSS score of <1% indicates a very low current likelihood of widespread exploitation, and the vulnerability is not listed in CISA’s KEV catalog, meaning no known large‑scale attacks have been reported. Nevertheless, in environments where admin credentials are accessible and the database user has sufficient privileges, the to gain unrestricted database and possibly OS access warrants immediate attention.