External risk intelligence

Friendica SQL Injection Allows Database Access

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-72550

Friendica is a decentralized social networking platform designed to be publicly accessible over the internet. The vulnerability exists in a photo-view parameter that is reachable by unauthenticated remote users, making the attack surface public-facing by design in normal deployments.

SQL Injection

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This vulnerability affects Friendica, a social networking platform, and could allow unauthorized individuals to access, alter, or delete your entire database. The main concern is confirming relevance and exposure.

Allows attackers to manipulate database data.
Matters because it impacts data integrity and privacy.
Confirm if your systems use this platform.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending a specially crafted request to a Friendica instance over the network. The request would target the photo-view feature, specifically manipulating the "order" parameter. Because this parameter is not properly secured, it can be used to inject malicious SQL code directly into a database query. If successful, this allows the attacker to read, alter, or delete all data within the database.

No authentication is required.
Manipulate photo-view order parameter.
Read, modify, or delete database.

Live Threat

Current exploitation, exposure, and threat context

This SQL injection vulnerability in Friendica could allow an unauthenticated remote attacker to execute arbitrary SQL commands. When supported by the advisory, this could lead to the unauthorized reading, modification, or deletion of the entire database.

Database integrity and contents.
Unauthenticated SQL command execution.
Complete data loss or corruption.

Operational Fix

Recommended remediation, mitigation, and detection steps

This SQL injection vulnerability in Friendica affects all unauthenticated remote attackers who can access the photo-view feature, allowing for database compromise. Responsibility for remediation likely falls to the platform or application owner who manages the Friendica instance, in coordination with infrastructure and security teams to assess business criticality and exposure. The first practical step is to identify all deployed Friendica instances, determine their internet reachability and business impact, and then assign ownership for remediation planning.

Platform/Application owners should manage remediation.
Verify internet-facing instances and business criticality.
Plan coordinated updates during maintenance windows.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Friendica?

Friendica is a decentralized social networking platform. It functions as a server-side application that allows users to communicate across various federated networks. Because it is designed for connectivity, administrators typically host Friendica instances so they are publicly reachable, enabling users to interact and share media content like photos.

What does CVE-2026-72550 mean for database security?

This vulnerability is classified as CWE-89, or SQL Injection. It occurs because the software fails to properly sanitize user-provided input before including it in a database query. For this specific CVE, the flaw allows an attacker to inject and execute their own SQL commands, which can lead to unauthorized access, modification, or complete deletion of all information stored in the system's database.

How can an attacker trigger this vulnerability?

An attacker can exploit this by sending a crafted network request to the photo-view feature of a Friendica instance. Specifically, they target the 'order' parameter. The vulnerability does not require the attacker to have an account or provide valid credentials to the system. Conversely, simply viewing photos normally or interacting with the platform's standard UI without specifically manipulating this underlying parameter will not trigger the flaw.

Is my Friendica instance at risk?

If you run an instance, you should assume risk if it is accessible over the network. According to Halo Surface Signal, Friendica is designed to be a public-facing platform, meaning the 'photo-view' component where this flaw resides is typically reachable by anyone on the internet. Instances that are not exposed to the public internet have a smaller attack surface, but internal-only deployments may still be reachable by unauthorized users within your network.

What should I do to address this issue?

The first step is to create an inventory of all Friendica instances deployed within your environment. Once identified, confirm which instances are accessible to the public versus those on internal networks to prioritize your response. Assign an owner to each instance to manage the update process and coordinate with your team to plan for maintenance windows to apply necessary patches provided by the vendor.

References

github.com/friendica/friendica

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.