The vulnerability arises when the message‑readers API processes an unvalidated ‘format’ query parameter and directly interpolates it into SQL statements using fmt.Sprintf. An attacker who is authenticated and has permission to read channel messages can alter the parameter to inject arbitrary SQL, potentially reading from or modifying data stored in the PostgreSQL or TimescaleDB backends.

The affected product is Magistrala (formerly Mainflux) as supplied by absmach. The injection flaw exists in both the PostgreSQL and TimescaleDB reader modules of the message‑readers API; specific version data is not provided.

With a CVSS score of 7.1, the weakness is considered high severity. The EPSS score is unavailable, and the vulnerability is not listed in the CISA KEV catalog. The attack requires authentication but does not mandate elevated privileges; any user who can query channel messages can exploit the flaw, suggesting a setting of the vulnerability that is limited to users with existing reading rights. The lack of protection via parameterized queries makes exploitation straightforward for an attacker with the necessary access.