CVE-2026-95590 describes a SQL Injection vulnerability in Tainacan versions up to 1.2.0. The flaw affects the Subscriber functionality and can be exploited remotely over the network by an attacker with low privileges without requiring user interaction. The vulnerability has a CVSS 3.1 base score of 7.1, indicating high severity, with attack vector network, high attack complexity, low privileges required, no user interaction, scope changed, high confidentiality impact, no integrity impact, and low availability impact.

Successful exploitation could allow an attacker to execute arbitrary SQL commands on the database, potentially exposing sensitive data (high confidentiality impact) and causing limited disruption to availability. There is no indication of integrity compromise. No known exploits are reported in the wild at this time.

No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the affected Subscriber functionality and monitor for suspicious activity related to SQL injection attempts.