CVE-2026-61518 is an authenticated SQL injection vulnerability in ISPConfig3's Remote API. The primary_id parameter used in delete and update API methods is concatenated directly into SQL WHERE clauses without integer casting or parameterized query binding. The built-in SQL injection scanner does not block quote-free boolean payloads and does not reject such requests by default. Consequently, a remote API user with minimal privileges can perform arbitrary SQL injection to delete or modify records across all tenants and extract sensitive data via blind boolean inference.

An attacker with any single low-privilege function permission on the Remote API can exploit this vulnerability to execute arbitrary SQL commands. This can lead to deletion or modification of records across all tenants in the control panel database and unauthorized extraction of sensitive data, including password hashes and client records. The vulnerability thus compromises data integrity and confidentiality across multiple tenants.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the Remote API to trusted users only and monitor for suspicious activity. Avoid granting unnecessary low-privilege function permissions that could be leveraged to exploit this vulnerability.