CVE-2026-93660highCWE-639

CVE-2026-93660: high-severity vulnerability in dataease SQLBot

SQLBot through 1.10.1 Improper Access Control via Dashboard Update

Published · Updated

Follow this CVE+ Monitor SQLBot

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 7.1epss 0.4%
SQLBot through 1.10.1 fails to verify dashboard ownership in update_resource and update_canvas endpoints, allowing authenticated workspace members to modify other users' private dashboards. Attackers can supply arbitrary dashboard IDs to rename dashboards and overwrite component data, canvas styles, and view information belonging to other workspace members.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
Affected products
dataease · SQLBot
Related CVEs — dataease SQLBot

In the same product, most dangerous first.

CVE-2026-32950HIGHSQLBot: RCE via SQL Injection in Excel Upload EndpointEPSS 0.9%CVE-2026-33324CRITICALSQLBot prompt injection allows arbitrary SQL execution and remote code executionEPSS 0.6%CVE-2026-32622HIGHSQLBot: Remote Code Execution via Terminology PoisoningEPSS 0.6%CVE-2026-53555MEDIUMStored XSS via SVG UploadEPSS 0.5%CVE-2026-53556MEDIUMSQLBot: Authenticated SQL Injection in previewData Resulting in Arbitrary File ReadEPSS 0.5%CVE-2025-69285HIGHSQLBot uploadExcel Endpoint has Unauthenticated Arbitrary File Upload vulnerabilityEPSS 0.5%