CVE-2026-38812 describes a SQL Injection vulnerability in RuoYi v4.8.2 affecting the /tool/gen/createTable endpoint. The issue resides in the code generation module and requires the attacker to have administrative authentication. Exploitation could lead to unauthorized access to sensitive database data. The vulnerability is classified under CWE-89 and has a critical CVSS 3.1 base score of 9.8. No official patch or remediation guidance is currently documented, and no known exploits are reported in the wild.

Successful exploitation of this vulnerability can result in unauthorized disclosure, modification, or deletion of sensitive database information. Given the high CVSS score (9.8), the impact affects confidentiality, integrity, and availability of the affected system. The attacker must have administrative privileges, which limits the attack surface but still poses a significant risk if such credentials are compromised or misused.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict administrative access to trusted users only and monitor for suspicious activity related to the /tool/gen/createTable endpoint. Avoid exposing this endpoint to untrusted networks. Follow vendor updates closely for any forthcoming patches or mitigations.