CVE-2026-90495 describes a SQL injection vulnerability in Fengoffice Feng Office versions up to 3.11.13.11. The flaw is located in the Legacy API component's Contacts::instance->findAll function in the file application/models/CompanyWebsite.class.php. By manipulating the auth argument, an attacker can perform SQL injection remotely. The vulnerability has been publicly disclosed, and the vendor has not provided a response or patch. The CVSS 3.1 base score is 7.3, indicating a medium severity impact on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability could allow an unauthenticated remote attacker to execute arbitrary SQL commands on the backend database. This can lead to unauthorized data disclosure, data modification, or denial of service. The CVSS vector indicates low attack complexity, no privileges required, and no user interaction needed, increasing the risk of exploitation. However, no known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no patch links are available, users should monitor official channels for updates. Until a fix is available, consider restricting access to the vulnerable API component or implementing web application firewall rules to detect and block SQL injection attempts targeting the auth parameter.