CVE-2026-77928 is a blind SQL injection vulnerability in ClipBucket v5 through 5.5.3. Authenticated users can submit the msg_id parameter as an array to bypass the clean_requests() sanitization function in ClipBucket.class.php. The unsanitized array elements are passed through the deletion handler in private_message.php into the cb_pm::delete_msg() function, which directly interpolates the unescaped message ID into a SQL query string. This flaw enables time-based blind SQL injection attacks that can retrieve sensitive database contents, including user credential hashes and email addresses.

An attacker with authentication privileges can exploit this vulnerability to perform time-based blind SQL injection, allowing extraction of arbitrary database contents. This includes sensitive information such as user credential hashes and email addresses, potentially leading to further compromise of user accounts and privacy violations.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict authenticated user privileges to limit access to the vulnerable functionality and monitor for suspicious activity related to message deletion operations.