CVE-2026-41478 | Saltcorn up to 1.4.5/1.5.5/1.6.0-beta.4 mobile-sync Routes sql injection (GHSA-jp74-mfrx-3qvh)

A vulnerability identified as critical has been detected in Saltcorn up to 1.4.5/1.5.5/1.6.0-beta.4. This vulnerability affects unknown code of the component mobile-sync Routes. Performing a manipulation results in sql injection.

This vulnerability is identified as CVE-2026-41478. The attack can be initiated remotely. There is not any exploit available.

You should upgrade the affected component.