CVE-2026-72565 — Tencent APIJSON - Unauthenticated SQL Injection via @having Operator Map-Form Bypass

CVE-2026-72565

Tencent APIJSON - Unauthenticated SQL Injection via @having Operator Map-Form Bypass PUBLISHED

Description (CNA)

A SQL injection vulnerability in Tencent APIJSON through 8.1.8 allows unauthenticated remote attackers to bypass per-table access control and read arbitrary database tables via the Map-form @having operator.

Affected (CNA)

Vendor / product	Versions
Tencent / APIJSON	affected 7.1.0 through 8.1.8

CWE

CWE-89

References

https://github.com/Tencent/APIJSON
https://github.com/Tencent/APIJSON/blob/master/APIJSONORM/src/main/java/apijson/orm/AbstractSQLConfig.java

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.