CVE-2026-93660highCWE-639

CVE-2026-93660: fallo de gravedad alta en dataease SQLBot

SQLBot through 1.10.1 Improper Access Control via Dashboard Update

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear SQLBot

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

21Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 7.1epss 0.4%
SQLBot through 1.10.1 fails to verify dashboard ownership in update_resource and update_canvas endpoints, allowing authenticated workspace members to modify other users' private dashboards. Attackers can supply arbitrary dashboard IDs to rename dashboards and overwrite component data, canvas styles, and view information belonging to other workspace members.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
Productos afectados
dataease · SQLBot
CVEs relacionadas — dataease SQLBot

En el mismo producto, de las más peligrosas a las menos.

CVE-2026-32950HIGHSQLBot: RCE via SQL Injection in Excel Upload EndpointEPSS 0.9%CVE-2026-33324CRITICALSQLBot prompt injection allows arbitrary SQL execution and remote code executionEPSS 0.6%CVE-2026-32622HIGHSQLBot: Remote Code Execution via Terminology PoisoningEPSS 0.6%CVE-2026-53555MEDIUMStored XSS via SVG UploadEPSS 0.5%CVE-2026-53556MEDIUMSQLBot: Authenticated SQL Injection in previewData Resulting in Arbitrary File ReadEPSS 0.5%CVE-2025-69285HIGHSQLBot uploadExcel Endpoint has Unauthenticated Arbitrary File Upload vulnerabilityEPSS 0.5%