CVE-2026-61518 is an authenticated SQL injection vulnerability in ISPConfig3's Remote API affecting versions 3.2.0 and 3.3.0. The primary_id parameter used in delete and update API methods is concatenated directly into SQL WHERE clauses without integer casting or parameterized queries, enabling injection of arbitrary SQL commands. The built-in SQL injection scanner does not block quote-free boolean payloads and does not reject such requests by default. An attacker with any single low-privilege function permission can exploit this flaw to delete or modify records across all tenants in the control panel database and extract sensitive data including password hashes and client records via blind boolean inference.

An attacker with authenticated access and minimal privileges can perform SQL injection attacks to delete or modify data across all tenants in the ISPConfig control panel database. The attacker can also extract sensitive information such as password hashes and client records through blind boolean inference. This compromises data integrity and confidentiality across multiple tenants.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the Remote API to trusted users only and monitor for suspicious activity. Avoid granting unnecessary low-privilege function permissions to users. Follow vendor updates closely for an official fix or mitigation.