Security readout for executives and security teams
Plain-English summary
An unauthenticated attacker could reportedly manipulate exposed APIJSON requests to bypass table-level access controls and read database tables they should not access. This creates a serious data-confidentiality risk. The supplied CVSS assessment also indicates possible integrity and availability impact, although the description only explicitly confirms unauthorized reading.
Executive priority
Treat as an immediate investigation and containment priority because unauthenticated database access could expose sensitive business or customer data. Establish deployment scope, restrict exposure, and obtain confirmed vendor remediation details. Escalate any evidence of unexpected table access through the incident-response process.
Technical view
CVE-2026-72565 is a CWE-89 SQL injection involving the Map form of APIJSON’s @having operator. The reported flaw bypasses per-table authorization and permits arbitrary table reads without authentication. The description says versions through 8.1.8 are affected, but the structured affected-product data lists only 7.1.0, leaving the precise version range uncertain.
Likely exposure
Highest risk applies to APIJSON deployments reachable by untrusted users, especially where requests can reach sensitive databases. Internet exposure increases urgency, but authentication at another layer does not establish safety. The supplied version information conflicts, so treat versions through 8.1.8 as potentially exposed pending authoritative vendor confirmation.
Exploitation context
The vulnerability has network reachability, low stated complexity, and requires neither privileges nor user interaction. The bundle provides no evidence of active exploitation, and it is not identified as a KEV entry. No public proof of concept is cited. Absence from KEV does not establish that exploitation has never occurred.
Researcher notes
The core claim is an authorization bypass enabled by SQL injection in Map-form @having processing. The supplied vulnerable-file reference identifies AbstractSQLConfig.java but does not establish the exact defective lines or remediation. Version metadata is inconsistent: 7.1.0 is explicitly listed, while the narrative says through 8.1.8. No fixed version, patch commit, vendor advisory, or exploitation evidence is supplied.
Mitigation direction
- Inventory APIJSON deployments, versions, network exposure, and connected database privileges immediately.
- Restrict affected interfaces to trusted networks while awaiting authoritative vendor remediation guidance.
- Check Tencent guidance for a confirmed fixed release and apply it when identified.
- Reduce APIJSON database-account privileges to only the tables and operations operationally required.
- Increase monitoring for unusual APIJSON queries and unauthorized table-access attempts.
Validation and detection
- Confirm deployed APIJSON versions using dependency inventories and build records.
- Verify whether untrusted clients can reach APIJSON request endpoints.
- Review database permissions granted to every account used by APIJSON.
- Search application and database logs for anomalous @having usage or unexpected table access.
- After remediation, test that unauthorized table requests remain denied without using production data.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-89: Database access and collection lookup
Injection into data stores can inform collection, data access, and exfiltration detection reviews. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupDatabase behavior lookup
The CVE wording references database injection or access, so collection and exfiltration review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2026-72565 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H3.95.9TuranSecVulnerability scoring details
Base CVSS 3.1 score
9.8CriticalVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- Source timelineTuranSec
CVE Reserved
- Source timelineTuranSec
Public Disclosure
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- ProductCVE reference, TuranSec · third-party-advisory
- Vulnerable FileCVE reference, TuranSec · technical-description
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.