CVE-2026-50769 Brainformatik CVE debrief

Who should care

Defenders responsible for the CRM+ application, particularly those in roles related to vulnerability management, incident response, and system administration, should assess exposure and prioritize verification of the version in use.

Why it matters

The CVE-2026-50769 SQL Injection vulnerability in CRM+ application requires defenders to verify versions, monitor for exploitation attempts, and implement compensating controls to prevent SQL injection attacks.

• Defenders should verify the version of CRM+ in use and assess exposure to the vulnerable endpoint.
• Defenders should monitor for potential exploitation attempts and implement compensating controls to prevent SQL injection attacks.
• Defenders should review and update the CRM+ application to a version that is not vulnerable.

Technical summary

The CRM+ application before and including version 2025.6 from Brainformatik is vulnerable to SQL Injection (time-based) vulnerability. The check conflict endpoint index.php?module=Appointments&action=CheckConflictOfDates&ajaxSkipHeader=true which is used to check any conflicts for user calendar is vulnerable to SQL injection allowing an attacker to execute arbitrary code. The vulnerability has a CVSS score of 9.8 and is considered critical. Defenders should verify the version of CRM+ in use and assess exposure to the vulnerable endpoint. They should also monitor for potential exploitation attempts and implement compensating controls to prevent SQL injection attacks.

Defensive priority

Defenders should prioritize verifying the version of CRM+ in use and assessing exposure to the vulnerable endpoint. They should also monitor for potential exploitation attempts and implement compensating controls to prevent SQL injection attacks.

Recommended defensive actions

• Verify the version of CRM+ in use and assess exposure to the vulnerable endpoint
• Monitor for potential exploitation attempts
• Implement compensating controls to prevent SQL injection attacks
• Review and update the CRM+ application to a version that is not vulnerable
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed

Evidence notes

The CVE record and NVD vulnerability detail page provide information about the vulnerability, including its CVSS score and severity. However, the corpus does not establish versions, exploitation, impact, or remediation beyond vendor and source references.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.