CVE-2025-15597
Dataease SQLBot API Endpoint assistant.py access control
CVSS Score
6.3
EPSS Score
0.0%
EPSS Percentile
0th
A vulnerability has been found in Dataease SQLBot up to 1.4.0. This affects an unknown function of the file backend/apps/system/api/assistant.py of the component API Endpoint. Such manipulation leads to improper access controls. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.5.0 mitigates this issue. The name of the patch is d640ac31d1ce64ce90e06cf7081163915c9fc28c. Upgrading the affected component is recommended. Multiple endpoints are affected. The vendor was contacted early about this disclosure.
| CWE | CWE-284 CWE-266 |
| Vendor | dataease |
| Product | sqlbot |
| Published | Mar 2, 2026 |
| Last Updated | Mar 2, 2026 |
Stay Ahead of the Next One
Get instant alerts for dataease sqlbot
Be the first to know when new medium vulnerabilities affecting dataease sqlbot are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Affected Versions
Dataease / SQLBot
1.0 1.1 1.2 1.3 1.4.0
References
vuldb.com: https://vuldb.com/?id.348291 vuldb.com: https://vuldb.com/?ctiid.348291 vuldb.com: https://vuldb.com/?submit.706144 vuldb.com: https://vuldb.com/?submit.707283 vuldb.com: https://vuldb.com/?submit.707284 vuldb.com: https://vuldb.com/?submit.707285 vuldb.com: https://vuldb.com/?submit.707286 vuldb.com: https://vuldb.com/?submit.707288 vuldb.com: https://vuldb.com/?submit.707293 vuldb.com: https://vuldb.com/?submit.707294 vuldb.com: https://vuldb.com/?submit.707295 github.com: https://github.com/yaowenxiao721/Poc/blob/main/SQLBot/SQLBot-User-Management-Broken-Access-Control.md github.com: https://github.com/dataease/SQLBot/security/advisories/GHSA-h4xm-3q3p-5g6r github.com: https://github.com/yaowenxiao721/Poc/blob/main/SQLBot/SQLBot-AIModel-Management-Missing-Authorization.md github.com: https://github.com/dataease/SQLBot/commit/d640ac31d1ce64ce90e06cf7081163915c9fc28c github.com: https://github.com/dataease/SQLBot/releases/tag/v1.5.0 github.com: https://github.com/dataease/SQLBot/
Credits
🔍 yaowenxiao (VulDB User) VulDB