CVE-2026-72565 in APIJSON
Sumário
de MITRE • 10/08/2026
A SQL injection vulnerability in Tencent APIJSON through 8.1.8 allows unauthenticated remote attackers to bypass per-table access control and read arbitrary database tables via the Map-form @having operator. The APIJSONORM library's AbstractSQLConfig.java applies the per-role allow-list check only on the String form of @having but not on the Map form, allowing a guest user to inject raw SQL fragments and read tables that are configured with get:[] (empty, meaning no role can read them).
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.