CVE-2026-38467: n/a

This vulnerability exists in GazellePW's tags manager, specifically in the handling of the tagid or type parameters in POST requests to tools.php?action=manage_tags. Authenticated users with users_mod privileges can exploit this SQL injection flaw to execute arbitrary SQL commands remotely. The CVSS 3.1 vector indicates the attack requires network access, low attack complexity, privileges, and no user interaction, with limited confidentiality and integrity impact and no availability impact.

An attacker with users_mod privileges can leverage this vulnerability to execute arbitrary SQL commands, potentially leading to unauthorized data access or modification within the database. The impact is limited to confidentiality and integrity, with no direct availability impact reported. The vulnerability requires authenticated access with specific privileges, reducing the attack surface.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict users_mod privileges to trusted users only and monitor for suspicious activity related to tag management. Avoid exposing the vulnerable endpoint to untrusted networks if possible.