CVE-2026-111390 in Erupt
Summary
by MITRE • 10/16/2026
Erupt through 2.3.0 contains an HQL injection vulnerability that allows authenticated users to bypass tree-scoped data filters by injecting unescaped quotes into the linkTreeVal parameter of POST /erupt-api/data/table/{erupt}. Attackers holding query permission on entities with String-keyed linkTree targets can append always-true OR clauses or boolean subqueries to read data from other mapped entities.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/16/2026
The vulnerability identified in Erupt versions prior to 2.3.0 represents a significant security flaw rooted in improper neutralization of special elements used in an SQL command, commonly known as HQL injection. This specific instance allows authenticated users who possess query permissions on certain entity types to bypass tree-scoped data filters that are designed to restrict access based on hierarchical relationships within the application's data model. The core technical failure occurs when processing requests directed at the POST /erupt-api/data/table/{erupt} endpoint, specifically through the linkTreeVal parameter which is intended to define the scope of a tree structure for filtering results. Instead of properly sanitizing or validating this input, the underlying framework constructs HQL queries by directly concatenating user-supplied values into the query string without adequate escaping mechanisms.
This architectural weakness enables an attacker with valid credentials and appropriate read permissions on entities that utilize String-keyed linkTree targets to manipulate the resulting database query logic. By injecting unescaped quotes followed by logical operators such as OR clauses or boolean subqueries, the adversary can alter the intended filtering conditions of the HQL statement. For instance, appending a condition like 'OR 1=1' effectively neutralizes the restrictive filters imposed by the tree-scoped data boundaries. This manipulation allows the attacker to retrieve records that fall outside their authorized hierarchical scope, thereby achieving an unauthorized bypass of access controls designed to isolate data segments based on organizational or logical trees.
The operational impact of this vulnerability is substantial for applications relying on strict multi-tenant isolation or role-based access control within hierarchical datasets. Since the attack requires authentication, it targets insider threats or compromised accounts rather than unauthenticated external attackers. However, once an attacker gains foothold with query permissions, they can exfiltrate sensitive information from other mapped entities that should remain inaccessible due to tree-scoping rules. This leads to a direct violation of data confidentiality and integrity principles, as the application fails to enforce its intended security boundaries regarding which subset of records each user is permitted to view. The ability to read data across different logical partitions undermines trust in the system's access control mechanisms and can lead to significant regulatory compliance issues depending on the sensitivity of the exposed data.
From a classification perspective, this vulnerability aligns with CWE-89: Improper Neutralization of Special Elements used in an SQL Command, specifically within the context of Hibernate Query Language (HQL). It also maps closely to MITRE ATT&CK technique T1059.004: SQL Injection under Command and Scripting Interpretation, although it is executed via a web API parameter rather than direct command execution. The bypass of tree-scoped filters further relates to CWE-269: Improper Privilege Management, as the attacker leverages existing low-level query permissions to achieve high-level data access that exceeds their intended privileges.
To mitigate this vulnerability, organizations running Erupt versions before 2.3.0 should immediately upgrade to version 2.3.0 or later where these input validation and sanitization issues have been addressed. For environments where upgrading is not immediately feasible, implementing a Web Application Firewall (WAF) with rules specifically tuned to detect HQL injection patterns in POST parameters can provide an additional layer of defense. Furthermore, developers should enforce strict parameterized queries or prepared statements when constructing dynamic HQL strings, ensuring that user inputs are treated strictly as data values rather than executable code components. Regular security audits focusing on input validation for all API endpoints handling hierarchical data structures are also recommended to prevent similar injection flaws in related modules.