CVE-2026-12188

Vulnerability

A SQL injection vulnerability exists in Grit42 Grit versions 0.0.x through 0.11.0 (every public release) in the GritEntityController of the file modules/core/backend/app/controllers/concerns/grit/core/grit_entity_controller.rb. The CSV export endpoint GET /api/grit/:engine/:resource/export accepts user-controlled params[:columns] which is passed directly into Model.unscoped.select(*params[:columns]), allowing injection of raw SQL fragments. The sink was introduced in the initial commit 79b9dfa and affects any resource declared with resources_with_export [1].

Exploitation

An attacker needs only an active user account with network access to the application. No specific role is required, as the before_action chain does not enforce :check_read for the export action, allowing even zero-role users to reach the endpoint. By crafting a columns[] parameter containing SQL sub-selects, an authenticated user can manipulate the SELECT clause of the PostgreSQL query used for CSV export. The exploit is publicly available [1].

Impact

Successful exploitation enables an attacker to exfiltrate arbitrary data from the database, including sensitive columns such as crypted_password, single_access_token, forgot_token, activation_token, and two_factor_token from the grit_core_users table. Since the single_access_token is accepted as a permanent Authorization: Bearer credential, leaking an admin token allows an attacker to escalate to full administrative privileges in a single request [1].

Mitigation

As of the publication date, the vendor has not responded to disclosure and no patch or workaround is available. Users should restrict network access to the affected endpoint or disable CSV export functionality until a fix is released. The vulnerability is publicly known, and exploit code is available [1].