CVE-2026-42463 PUBLISHED

SQLBot: Unauthorized Access Vulnerability

Assigner: GitHub_M
Reserved: 27.04.2026 Published: 13.05.2026 Updated: 13.05.2026

SQLBot is an intelligent Text-to-SQL system based on large language models and RAG. Prior to 1.8.0, SQLBot contains a Cross-Workspace IDOR (Insecure Direct Object Reference) and Authorization Bypass vulnerability in the /api/v1/datasource/exportDsSchema and /api/v1/datasource/uploadDsSchema endpoints. An attacker can access and modify database schemas and data sources belonging to other tenants/workspaces. This vulnerability is fixed in 1.8.0.

Metrics

CVSS 4.0

CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
CVSS Score: 8.6

Exploitability Metrics		Vulnerable System Impact Metrics		Subsequent System Impact Metrics
Attack Vector	Network	Confidentiality	High	Confidentiality	None
Attack Complexity	Low	Integrity	High	Integrity	None
Attack Requirements	None	Availability	None	Availability	None
Privileges Required	Low
User Interaction	None

CVSS 4.0

Product Status

Vendor	dataease
Product	SQLBot
Versions	Version < 1.8.0 is affected

References

https://github.com/dataease/SQLBot/security/advisories/GHSA-pq2r-fj48-xfpp

Problem Types

CWE-639: Authorization Bypass Through User-Controlled Key CWE