CVE-2026-62361

### Summary A SQL injection vulnerability in `GET /api/subscribers/export` allows an authenticated user with the `subscribers:sql_query` permission to bypass the table access control that exists on the regular query endpoint (`GET /api/subscribers`) and read arbitrary tables from the database — including `users` (bcrypt password hashes) and `settings` (SMTP credentials, API keys). Both error-based and time-based exfiltration techniques are confirmed to work. This creates a privilege escalation path: `subscribers:sql_query` → hash exfiltration → offline bcrypt crack (cost factor 6) → Super Admin account takeover. --- ### Details The subscriber query feature accepts a user-controlled `query` parameter that is injected directly into a SQL template via `strings.ReplaceAll`. The regular query endpoint `GET /api/subscribers` correctly calls `validateQueryTables` to block access to sensitive tables before execution. The export endpoint `GET /api/subscribers/export` **omits this call entirely**, creating an asymmetric bypass of an intentional security control. **`internal/core/subscribers.go` — protected path (regular query):** ```go // QuerySubscribers — table validation present stmt := strings.ReplaceAll(c.q.QuerySubscribersTpl, "%query%", cond) if err := validateQueryTables(c.db, stmt, allowedSubQueryTables); err != nil { return nil, 0, echo.NewHTTPError(http.StatusBadRequest, fmt.Sprintf("Error preparing subscriber query: %v", err)) } ``` **`internal/core/subscribers.go` — vulnerable path (export):** ```go // ExportSubscribers — NO table validation stmt := strings.ReplaceAll(c.q.QuerySubscribersForExport, "%query%", cond) tx, err := c.db.Preparex(stmt) // executes directly without restriction ``` **`queries/subscribers.sql` — the `%query%` placeholder is injected into a WHERE clause:** ```sql SELECT subscribers.id, subscribers.email, ... FROM subscribers LEFT JOIN subscriber_lists ON ... WHERE (subscribers.status != 'blocklisted') AND %query% ORDE