This vulnerability (CVE-2026-66619) is an SQL Injection flaw classified under CWE-89 in Tribulant Software Newsletters versions up to 4.18. It occurs because the software fails to properly neutralize special elements used in SQL commands, allowing an authenticated administrator to execute arbitrary SQL code. The CVSS 3.1 vector indicates the attack requires network access with low complexity, privileges required are high (administrator), no user interaction is needed, and the scope is changed. The impact is high confidentiality loss and low availability impact, with no integrity impact reported.

An attacker with administrator privileges can exploit this vulnerability to execute arbitrary SQL commands on the backend database. This can lead to unauthorized disclosure of sensitive information (high confidentiality impact) and partial disruption of service (low availability impact). There is no reported impact on data integrity. The vulnerability requires administrator-level privileges, limiting exploitation to trusted users with elevated access.

No patch or official fix information is currently available. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, restrict administrator access to trusted personnel only and monitor for suspicious activity. Avoid exposing administrative interfaces to untrusted networks.