CVE-2026-72565
CriticalCVSS 9.8Summary
A SQL injection vulnerability in Tencent APIJSON through 8.1.8 allows unauthenticated remote attackers to bypass per-table access control and read arbitrary database tables via the Map-form @having operator. The APIJSONORM library's AbstractSQLConfig.java applies the per-role allow-list check only on the String form of @having but not on the Map form, allowing a guest user to inject raw SQL fragments and read tables that are configured with get:[] (empty, meaning no role can read them).
Risk Assessment
An attacker can access sensitive data in the database, leading to confidentiality breaches, data leakage, and potential regulatory non-compliance.
Recommendation
Update APIJSON to a patched version that applies access control to the Map form of @having as well, and conduct a security audit of SQL queries.
Original NVD description (English source)
A SQL injection vulnerability in Tencent APIJSON through 8.1.8 allows unauthenticated remote attackers to bypass per-table access control and read arbitrary database tables via the Map-form @having operator. The APIJSONORM library's AbstractSQLConfig.java applies the per-role allow-list check only on the String form of @having but not on the Map form, allowing a guest user to inject raw SQL fragments and read tables that are configured with get:[] (empty, meaning no role can read them).