CVE-2026-38158 is a SQL injection vulnerability affecting ureport version 2.2.9. The issue resides in the /ureport/datasource/previewData component, where insufficient input sanitization allows attackers to inject malicious SQL queries. This can lead to unauthorized access to sensitive database information. The vulnerability has been publicly disclosed but lacks a CVSS score and official remediation details. No known exploits have been reported in the wild.

Successful exploitation of this vulnerability can result in unauthorized disclosure of sensitive database information. This may compromise confidentiality and potentially lead to further attacks depending on the data accessed. There is no indication of remote code execution or privilege escalation from the provided data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to the vulnerable component and applying input validation controls where possible to mitigate injection risks.