CVE-2026-57667 is a SQL Injection vulnerability (CWE-89) in Adrian Tobey's Groundhogg product, affecting all versions up to 4.5 inclusive. The issue arises from improper neutralization of special elements used in SQL commands within the Sales Representative component. The vulnerability has a CVSS 3.1 base score of 8.5, indicating high severity with network attack vector, low attack complexity, requiring low privileges and no user interaction. The impact includes high confidentiality loss and low availability impact. There is no vendor advisory or patch available at this time, and no known exploits in the wild have been reported.

An attacker with low privileges can exploit this SQL Injection vulnerability remotely without user interaction to gain unauthorized access to sensitive data (high confidentiality impact) and cause limited disruption to service availability (low availability impact). Integrity impact is not affected. This could lead to data leakage or partial compromise of the affected system's database.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected Groundhogg installations and monitor for suspicious activity related to SQL injection attempts. Avoid exposing the vulnerable component to untrusted networks where possible.