CVE-2026-76571

Name of the Vulnerable Software and Affected Versions Fabrik versions prior to 4.7.2

Description An unauthenticated attacker can perform a SQL injection by supplying arbitrary SQL through the condition parameter passed to a list filter. This occurs because the parameter is concatenated verbatim into the WHERE clause constructed by the getFilterQuery() function, potentially allowing full read access to the database.

Recommendations Update to version 4.7.2 or later. As a temporary mitigation, restrict access to the list filter functionality that utilizes the condition parameter.