This vulnerability (CVE-2026-40826) in MB connect line's mbCONNECT24 product arises from improper neutralization of special elements in a SQL SELECT command within the dsgvo_contracts view. An unauthenticated attacker with high privileges can perform SQL Injection, potentially leading to unauthorized data disclosure. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no user interaction, and high impact on confidentiality. No vendor advisory or patch information is currently provided, and the product is not a cloud service.

Exploitation of this vulnerability can result in a total loss of confidentiality of data accessible via the vulnerable SQL view. As the attacker is unauthenticated but requires high privileges, the impact is significant but limited by the privilege requirement. There is no indication of impact on integrity or availability. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or workaround is currently documented, users should monitor vendor communications for updates. Restricting access to the vulnerable component and applying principle of least privilege may reduce risk until a fix is available.