Executive Summary

CVE-2026-12206 is a SQL injection vulnerability found in the grit42 Data Table Entity Endpoint, specifically in versions 0.8.0 through 0.11.0 of the grit-assays module.

The flaw exists in the Grit::Assays::DataTableEntity model where user input from params[:data_table_id] is directly inserted into a SQL JOIN clause without proper sanitization.

Although the input is coerced to an integer when calling DataTable.find(params[:data_table_id]), the raw unsanitized value is later used in the JOIN clause, enabling attackers to inject malicious SQL.

This allows authenticated attackers, even those with zero roles, to perform boolean-based blind SQL injection attacks to extract sensitive data such as administrator tokens.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can have severe impacts including unauthorized access and data exfiltration.

• Attackers can extract sensitive information such as hashed passwords, API tokens, password-reset tokens, activation tokens, and second-factor authentication tokens.
• In multi-tenant environments, a single low-privilege account can exfiltrate all research data and impersonate administrators.
• Attackers can achieve full account takeover by replaying stolen administrator tokens.
• In PostgreSQL containers running with SUPERUSER privileges, the vulnerability can also allow arbitrary file reads.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by testing the grit42 Data Table Entity Endpoint for SQL injection flaws, specifically by targeting the parameter `data_table_id` in requests to the affected endpoint.

Since the vulnerability allows boolean-based blind SQL injection, detection can involve sending crafted requests with SQL payloads in the `data_table_id` parameter and observing the responses for anomalies or differences indicating injection success.

• Use curl or similar tools to send requests with SQL injection payloads in the `data_table_id` parameter, for example: `curl -X GET 'https://target/grit42/assays/data_table_entity?data_table_id=1 OR 1=1'`
• Automated SQL injection detection tools or scanners can be used against the endpoint to identify injection points.
• Monitor logs for unusual or malformed SQL queries or errors related to the `data_table_id` parameter.

Useful 0 Not Useful 0

Mitigation Strategies

The immediate mitigation step is to ensure that the `data_table_id` parameter is properly sanitized before being used in SQL queries.

Specifically, convert the `data_table_id` parameter to an integer before interpolating it into the JOIN clause, as this aligns with the existing `DataTable.find()` contract and prevents injection.

Restrict access to the vulnerable endpoint to only trusted and authenticated users with appropriate roles, if possible.

Monitor for any exploitation attempts and apply any available patches or updates from the vendor once they become available.

Useful 0 Not Useful 0

Compliance Impact

This SQL injection vulnerability in grit42 allows attackers to extract sensitive data such as hashed passwords, API tokens, password-reset tokens, activation tokens, and second-factor tokens. In multi-tenant environments, it enables exfiltration of all research data and impersonation of administrators, leading to unauthorized access and potential data breaches.

Such unauthorized access and data exposure can lead to non-compliance with data protection regulations like GDPR and HIPAA, which mandate strict controls over personal and sensitive data to prevent breaches and ensure confidentiality, integrity, and availability.

Useful 0 Not Useful 0