The vulnerability identified as CVE-2026-51346 affects StudIP versions 6.0.x prior to 6.0.3 and 5.4.x prior to 5.4.12. It is a SQL Injection issue (CWE-89) that enables unauthenticated remote attackers to execute arbitrary code and retrieve sensitive data through the store() functions. The CVSS 3.1 score is 9.1, indicating a critical severity with network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality and integrity but no impact on availability.

Successful exploitation can lead to remote code execution and unauthorized disclosure of sensitive information, compromising the confidentiality and integrity of the affected system. There is no indication of availability impact. No known exploits in the wild have been reported yet.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch links or vendor advisories are provided, users should monitor official StudIP channels for updates and apply patches for versions 6.0.3 or later and 5.4.12 or later once available.