The updated details describe that Magistrala's message‑readers API accepts a ‘format’ query parameter without validation, and directly interpolates it into SQL queries using fmt.Sprintf. Because the parameter is used by any authenticated user who can read channel messages, an attacker can craft a malicious value to execute arbitrary SQL commands against the PostgreSQL or TimescaleDB backends, leading to data disclosure or tampering.

The affected product is Magistrala (formerly Mainflux) as supplied by absmach. The injection flaw exists in both the PostgreSQL and TimescaleDB reader modules of the message‑readers API; specific version data is not provided.

With a CVSS score of 7.1, the weakness is considered high severity. The EPSS score of 0.00191 (< 1%) indicates a very low but non-zero probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The attack requires authentication but does not mandate elevated privileges; any user who can query channel messages can exploit the flaw, suggesting a setting of the vulnerability that is limited to users with existing reading rights. The lack of protection via parameterized queries makes exploitation straightforward for an attacker with the necessary access.