CVE-2026-12188 describes a SQL injection vulnerability in Grit42 Grit versions up to 0.11.0. The vulnerability resides in the GritEntityController component, specifically in the file modules/core/backend/app/controllers/concerns/grit/core/grit_entity_controller.rb. An attacker can remotely manipulate input to execute SQL injection attacks. The vulnerability has a CVSS 3.1 base score of 6.3, indicating a medium severity impact with network attack vector, low attack complexity, and no user interaction required. The vendor was contacted but did not respond, and no official patch or fix has been published.

Successful exploitation of this vulnerability could allow an attacker with low privileges to perform SQL injection remotely, potentially leading to unauthorized data access, data modification, or denial of service. The CVSS score of 6.3 reflects limited confidentiality, integrity, and availability impacts. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no patch is available, users should consider implementing application-level mitigations such as input validation and parameterized queries if possible. Monitor official channels for updates or patches from the vendor.