CVE-2026-38158

Name of the Vulnerable Software and Affected Versions ureport version 2.2.9

Description A SQL injection issue exists in the /ureport/datasource/previewData endpoint, which handles datasource preview queries. The flaw stems from improper input validation and the use of unsafely constructed SQL statements, allowing attacker-controlled input to be executed by the database. An attacker with network access to the application can send crafted SQL payloads to this endpoint to perform unauthorized database reads and expose sensitive information. Depending on database permissions and configuration, this could lead to a broader compromise of backend data stores.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. Restrict access to the /ureport/datasource/previewData endpoint to minimize the risk of exploitation.