External risk intelligence

Brainformatik CRM+ SQL Injection Vulnerability.

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-50769

The vulnerability exists in a CRM application's appointment and calendar management module, which is typically accessible via web interfaces for user interaction. These web-based business applications are commonly deployed as internet-facing services to support remote access and external calendar management.

SQL Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in the CRM+ application, impacting its calendar and appointment features. This SQL injection flaw could allow unauthorized individuals to execute arbitrary code, potentially compromising system integrity and sensitive data. The main concern is to confirm if this application is in use and assess any potential exposure.

Vulnerability allows unauthorized code execution.
Impacts calendar and appointment features.
Confirm relevance and assess exposure.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending a specially crafted request to the CRM+ application's `CheckConflictOfDates` endpoint. This endpoint, used for checking calendar conflicts, is exposed externally and does not appear to require authentication. If successful, an attacker could inject malicious SQL commands, potentially leading to arbitrary code execution.

No authentication needed to access.
Triggered via `CheckConflictOfDates` endpoint.
Leads to arbitrary code execution.

Live Threat

Current exploitation, exposure, and threat context

When supported by the advisory, an attacker could exploit a time-based SQL injection vulnerability in the CRM+ application's calendar conflict check to execute arbitrary code. This could affect user calendar data and potentially allow unauthorized actions within the application.

User calendar data.
Via a vulnerable web endpoint.
Arbitrary code execution.

Operational Fix

Recommended remediation, mitigation, and detection steps

The CRM+ application's SQL injection vulnerability requires coordination between the application owners, platform team, and potentially the vendor for remediation. The first step is to confirm the deployment scope, identify business-critical instances, and determine the accountable owner to prioritize and plan the update.

Application owners must address the issue.
Verify external accessibility and business criticality.
Plan remediation based on risk and vendor coordination.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Brainformatik CRM+ software?

CRM+ is a business software suite developed by Brainformatik designed to manage customer relationships, internal schedules, and user appointments. It acts as a central repository for calendar data and coordination, often integrated into organizational workflows to track meetings and manage time-sensitive administrative tasks.

What does SQL injection mean for CVE-2026-50769?

This CVE involves a time-based SQL injection, classified as CWE-89. In simple terms, it means the application fails to properly filter user input before processing it in a database query. By sending specific data, an attacker can manipulate the underlying database logic, potentially forcing the server to execute unauthorized commands or reveal sensitive information.

How is this SQL injection triggered?

The vulnerability is triggered when an attacker sends a crafted request to the application's appointment conflict check endpoint. Crucially, this specific path does not require the user to be logged in, meaning the system processes the request before verifying the user's identity. Requests that do not interact with this calendar-checking function do not trigger this specific flaw.

Do I need to worry if my CRM+ instance is internal?

According to Halo Surface Signal, this software is often deployed as an internet-facing service to enable remote access and external calendar management. While internal-only instances face a lower risk of automated discovery, any instance reachable from a network accessible by untrusted parties should be considered at risk due to the lack of required authentication.

When should I start responding to this CVE?

You should begin by verifying your organization's deployment of CRM+ immediately. Identify which servers run the affected software, determine who owns those instances, and coordinate with your platform team to prepare for vendor-supplied updates. Prioritize instances that handle sensitive calendar data or are visible to wider network segments.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.