CVE-2026-4815
Published: 25 March 2026
Summary
CVE-2026-4815 is a high-severity SQL Injection (CWE-89) vulnerability in Schiocco Support Board. Its CVSS base score is 8.7 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 15.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-4815 is a SQL injection vulnerability (CWE-89) in Support Board version 3.7.7. The issue affects the 'calls[0][message_ids][]' parameter in the '/supportboard/include/ajax.php' endpoint, allowing attackers to retrieve, create, update, and delete database content. Published on 2026-03-25, it carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), reflecting high severity due to its potential for significant data manipulation.
An attacker with low privileges, such as an authenticated user, can exploit this vulnerability remotely over the network with low complexity and no user interaction required. Successful exploitation grants high-impact control over confidentiality, integrity, and availability, enabling arbitrary database operations like data exfiltration, modification, insertion, or deletion.
The INCIBE-CERT advisory at https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-support-board-schiocco details this and other vulnerabilities in Support Board by Schiocco, providing guidance on mitigations.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-15415
- 🇪🇸 INCIBE: www.incibe.es
Vulnerability details
A SQL Injection vulnerability has been found in Support Board v3.7.7. This vulnerability allows an attacker to retrieve, create, update and delete database via 'calls[0][message_ids][]' parameter in '/supportboard/include/ajax.php' endpoint.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
SQL injection in web app endpoint directly enables T1190 (public-facing app exploitation), T1213.006 (DB content retrieval), T1565.001 (stored data insert/update), and T1485 (data deletion/destruction).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SI-10 directly prevents SQL injection by requiring validation of untrusted inputs like the 'calls[0][message_ids][]' parameter before database queries.
SI-2 mandates timely remediation of known flaws such as CVE-2026-4815 through patching Support Board to version 3.7.8 or later.
SI-9 restricts the vulnerable 'message_ids' parameter to authorized types, lengths, and formats, such as numeric IDs only, blocking SQL injection payloads.