CVE-2026-6093 is a SQL injection vulnerability (CWE-89) in the Corteza project, specifically in version 2024.9.8. The vulnerability arises in the Microsoft SQL Server backend when filtering Compose records by the meta field, where user input is not properly sanitized before being used in SQL commands. This could potentially allow an attacker with low privileges and no user interaction to influence the SQL query execution, leading to partial compromise of data confidentiality or integrity. The CVSS 4.0 base score is 6.0 (medium severity), reflecting network attack vector, low attack complexity, partial attack prerequisites, and high impact on confidentiality.

Successful exploitation of this vulnerability could allow an attacker to execute unauthorized SQL commands on the Corteza MSSQL backend when filtering Compose records by meta fields. This may lead to unauthorized data access or modification. However, the impact is limited by the requirement of low privileges and partial attack prerequisites. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary workaround is currently documented, users should monitor vendor communications for updates. Until a patch is available, restricting access to the affected functionality and applying principle of least privilege may reduce risk.