CVE-2026-84859

ScadaLTS 2.8.1-release-candidate build 0 is affected by an Authenticated Blind SQL Injection

The /api/events/search endpoint accepts a JSON body containing a sortBy array. The values in this array are concatenated directly into the SQL ORDER BY clause without any sanitization or parameterization. This allows authenticated users with the ROLE USER role to perform time-based and boolean-based blind SQL injection to extract arbitrary data from the database, including password hashes of all users.

The endpoint is accessible to any authenticated user with ROLE USER, ROLE ADMIN, or ROLE PUBLIC via POST /api/events/search as defined in spring-security.xml.