CVE-2026-39771: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in MightyNetworks vs BuddyBoss Buddyboss Platform

This vulnerability (CVE-2026-39771) is an instance of CWE-89, SQL Injection, in the Buddyboss Platform up to version 3.1.0. The issue arises from improper neutralization of special elements used in SQL commands within the Subscriber component. The CVSS 3.1 score is 8.5 (high), with an attack vector of network, low attack complexity, requiring low privileges and no user interaction. The impact includes high confidentiality loss and low availability impact, with no integrity impact. No known exploits in the wild or vendor patches are currently documented.

Successful exploitation could allow an attacker to read sensitive data from the database (high confidentiality impact) and cause partial denial of service (low availability impact). Integrity of data is not impacted. The attack requires network access and low privileges but no user interaction, making it a significant risk if unpatched.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are currently provided. Until a patch is available, restrict access to the affected component and monitor for suspicious activity related to SQL injection attempts.