CVE-2026-14920 is a SQL Injection vulnerability (CWE-89) affecting the AcyMailing product. The vulnerability allows remote attackers to inject SQL commands without authentication, resulting in high confidentiality impact and limited integrity impact. The CVSS v3.1 score is 8.2, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and unchanged scope. No patch or official remediation level has been published as of the data available.

An attacker can exploit this vulnerability to access or disclose sensitive information from the database (high confidentiality impact). The integrity of the data may be partially compromised (low integrity impact). There is no impact on availability. The vulnerability can be exploited remotely without authentication or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, users should monitor vendor communications for updates and consider applying any available workarounds or temporary mitigations recommended by the vendor once available.