CVE-2026-72565

CRITICAL 9.8

Tencent APIJSON - Unauthenticated SQL Injection via @having Operator Map-Form Bypass

CVSS Score

9.8

EPSS Score

0.0%

EPSS Percentile

0th

A SQL injection vulnerability in Tencent APIJSON through 8.1.8 allows unauthenticated remote attackers to bypass per-table access control and read arbitrary database tables via the Map-form @having operator.

CWE	CWE-89
Vendor	tencent
Product	apijson
Published	Aug 10, 2026
Last Updated	Aug 10, 2026

Stay Ahead of the Next One

Get instant alerts for tencent apijson

Be the first to know when new critical vulnerabilities affecting tencent apijson are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Affected Versions

Tencent / APIJSON

7.1.0 ≤ 8.1.8

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/Tencent/APIJSON github.com: https://github.com/Tencent/APIJSON/blob/master/APIJSONORM/src/main/java/apijson/orm/AbstractSQLConfig.java

Credits

Bobur Abdugafforov