CVE-2026-12918

Name of the Vulnerable Software and Affected Versions Mail Mint versions prior to 1.24.2

Description This issue is a second-order SQL injection, where a malicious payload is first stored and later executed. Authenticated attackers with administrator-level access or higher can append additional SQL queries to extract sensitive information from the database. The process begins when a payload is stored unsanitized via a POST request to the '/mrm/v1/campaigns/' endpoint, bypassing the filter recipients() validation. The injection is subsequently triggered by a GET request to the '/mrm/v1/campaigns/{id}' endpoint, which deserializes the recipients parameter and passes the raw ID string through the array column() function into a vulnerable query. This occurs due to insufficient escaping of the recipients parameter and a lack of proper preparation of the SQL query.

Recommendations Update to a version newer than 1.24.1.