CVE-2026-19354 describes a SQL injection vulnerability in lock-upme OPMS up to commit 831440f37a92c1568f2e071d5233bc873a9d8b09. The flaw is located in an unknown function within controllers/messages/message.go in the IN Clause Handler component. By manipulating the 'ids' argument, an attacker can perform SQL injection remotely. Due to the product's rolling release model, no explicit affected or fixed versions are specified. The vendor was contacted but did not provide any response or patch information.

Successful exploitation of this vulnerability could allow an attacker with low privileges to perform SQL injection attacks remotely, potentially leading to unauthorized data access, modification, or denial of service. The CVSS score reflects limited confidentiality, integrity, and availability impacts, all rated low but present.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no patch links are available, users should monitor official channels for updates. Until a fix is available, consider restricting access to the vulnerable component or applying application-layer protections such as input validation or web application firewalls targeting SQL injection patterns.