CVE-2026-72565

Tencent APIJSON (up to 8.1.8) contains a SQL injection in the Map-form @having operator that bypasses per-table access control, enabling unauthenticated remote attackers to read arbitrary database tables. The APIJSONORM AbstractSQLConfig.java applies per-role allow-list checks only to the String ...

CVE-2026-72565 Tencent APIJSON - Unauthenticated SQL Injection via @having Operator Map-Form Bypass

A SQL injection vulnerability in Tencent APIJSON through 8.1.8 allows unauthenticated remote attackers to bypass per-table access control and read arbitrary database tables via the Map-form @having operator...