CVE-2026-71622: n/a

This vulnerability is a SQL injection flaw in Zhao-github APiAdmin v5.0.1 specifically in the User.php component. An unauthenticated remote attacker can exploit this to retrieve sensitive data from the backend database. The CVSS 3.1 base score is 7.4, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, and a confidentiality impact classified as high. No official patch or remediation information is provided in the source data.

Successful exploitation can lead to unauthorized disclosure of sensitive information from the application database. There is no indication of impact on data integrity or system availability. The vulnerability could be leveraged by remote attackers without privileges but requires user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, limit exposure by restricting access to the affected component and monitoring for suspicious activity related to User.php. Avoid user actions that could trigger the vulnerability if possible.