This vulnerability (CVE-2026-39574) is an unauthenticated SQL Injection (CWE-89) in InPost Gallery versions up to 2.1.4.6. It allows remote attackers to inject malicious SQL commands without requiring authentication, which can lead to unauthorized disclosure of sensitive data (high confidentiality impact) and limited denial of service (low availability impact). The CVSS 3.1 base score is 9.3, reflecting the critical severity and ease of exploitation (network vector, low attack complexity, no privileges or user interaction required). There is no vendor advisory or patch available at this time, and no known exploits in the wild have been reported.

Successful exploitation can result in unauthorized access to sensitive database information due to SQL Injection, impacting confidentiality severely. Integrity is not impacted according to the CVSS vector, and availability impact is low but present. The vulnerability is exploitable remotely without authentication, increasing risk.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider applying web application firewall (WAF) rules to detect and block SQL injection attempts targeting InPost Gallery. Monitor for updates from RealMag777 regarding official patches or mitigations.