CVE-2026-12188 identifies a SQL injection vulnerability in the file modules/core/backend/app/controllers/concerns/grit/core/grit_entity_controller.rb of Grit42 Grit up to version 0.11.0. The vulnerability arises from improper input handling in the GritEntityController component, allowing remote attackers to perform SQL injection attacks. The vendor was notified but has not provided a response or patch. The vulnerability is publicly known, but no known exploits in the wild have been reported.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database remotely, potentially leading to unauthorized data access or modification. The CVSS 4.0 base score of 5.3 reflects a medium severity with network attack vector, low attack complexity, and no user interaction required. However, the impact on confidentiality, integrity, and availability is limited to low.

No official fix or patch is currently available from the vendor, and the vendor has not responded to the disclosure. Users should monitor the vendor's channels for any future updates or patches. Until a fix is released, consider implementing application-layer input validation and using database query parameterization as temporary mitigations to reduce the risk of SQL injection.