CVE-2026-72565 in APIJSON
Summary
by MITRE • 08/10/2026
A SQL injection vulnerability in Tencent APIJSON through 8.1.8 allows unauthenticated remote attackers to bypass per-table access control and read arbitrary database tables via the Map-form @having operator. The APIJSONORM library's AbstractSQLConfig.java applies the per-role allow-list check only on the String form of @having but not on the Map form, allowing a guest user to inject raw SQL fragments and read tables that are configured with get:[] (empty, meaning no role can read them).
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/10/2026
This vulnerability represents a critical security flaw in Tencent APIJSON versions up to 8.1.8 that enables unauthorized remote attackers to circumvent access controls through a SQL injection vector exploiting the Map-form having operator. The issue stems from an inconsistent implementation of access control checks within the APIJSONORM library where the AbstractSQLConfig.java file performs per-role allow-list validation only on the String representation of the having clause while completely bypassing this security check for the Map-form variant. This discrepancy creates a pathway for malicious actors to inject arbitrary SQL fragments directly into database queries, effectively allowing them to access table data that should be restricted based on role-based permissions.
The technical exploitation occurs because the system's access control mechanism fails to properly validate and sanitize Map-form having parameters before incorporating them into SQL execution paths. When a guest user submits a request containing a Map-form having clause, the application processes this input without applying the same security validations that would normally prevent unauthorized database access. This creates an attack surface where even tables configured with get:[] (indicating no roles should be able to read them) become accessible to unauthenticated users who can craft malicious SQL fragments through the vulnerable Map-form @having operator.
The operational impact of this vulnerability extends beyond simple data leakage as it fundamentally undermines the application's role-based access control model. Attackers can leverage this weakness to bypass security boundaries and extract sensitive information from database tables that should remain protected, potentially leading to data breaches, unauthorized data manipulation, or further exploitation opportunities. The vulnerability affects any system using Tencent APIJSON with versions up to 8.1.8 and specifically targets the ORM functionality that handles SQL query construction and execution. This flaw directly violates security principles related to least privilege and access control enforcement, creating a persistent risk for organizations relying on this framework for their backend services.
Organizations should immediately implement mitigations including upgrading to patched versions of Tencent APIJSON where the vulnerability has been addressed by ensuring consistent validation of both String and Map forms of @having parameters. The fix requires implementing comprehensive input sanitization and access control checks across all parameter formats to prevent SQL injection attacks. Additionally, system administrators should conduct thorough security assessments of their APIJSON implementations to identify any other potential inconsistencies in access control enforcement that could create similar vulnerabilities. This vulnerability aligns with CWE-89, which describes SQL injection flaws, and represents a specific instance of improper input validation that enables unauthorized database access through the use of Map-form parameters in API configurations.
The attack pattern associated with this vulnerability follows established techniques from the ATT&CK framework under the T1213 Data Exploitation phase where adversaries target database systems to extract sensitive information. The weakness specifically manifests as a privilege escalation vector where guest users can gain unauthorized access to restricted data through manipulation of the having operator in Map-form requests. Security teams should implement monitoring solutions that detect anomalous SQL query patterns and parameter usage, particularly focusing on unexpected Map-form having clauses that could indicate exploitation attempts. Network-level protections including web application firewalls and database activity monitoring systems can help detect and prevent exploitation attempts while organizations maintain regular vulnerability scanning procedures to identify similar inconsistencies in their API frameworks and ORM implementations across the enterprise infrastructure.
This vulnerability demonstrates how seemingly minor implementation inconsistencies in security controls can create significant risks, particularly when dealing with role-based access control mechanisms in database interaction frameworks. The flaw highlights the importance of consistent security validation across all input parameter formats within applications and reinforces the need for comprehensive testing of access control mechanisms to ensure they function correctly regardless of input representation. Organizations should treat this as a critical reminder that security controls must be applied uniformly across all code paths rather than selectively based on input format or data type.