CVE-2026-72565

Name of the Vulnerable Software and Affected Versions Tencent APIJSON versions prior to 8.1.9

Description A SQL injection issue exists that allows unauthenticated remote attackers to bypass per-table access control and read arbitrary database tables. The flaw is located in the APIJSONORM library's AbstractSQLConfig.java file, where the per-role allow-list check is applied only to the String form of the @having operator and not to the Map form. This allows a guest user to inject raw SQL fragments and access tables configured with get:[] (an empty list indicating no role has read permissions).

Recommendations Update Tencent APIJSON to version 8.1.9 or later. As a temporary mitigation, restrict the use of the @having operator in Map form.