CVE-2026-42096: Sparx Pro Cloud Server SQLi Vulnerability

CVE-2026-42096 Overview

CVE-2026-42096 is a broken access control vulnerability in Sparx Systems Pro Cloud Server (PCS) affecting communication between the application and its underlying database. The flaw allows any authenticated low-privileged user to execute arbitrary SQL queries within the database user context due to missing permission checks. Version 6.1 (build 167) and earlier are confirmed vulnerable. Other versions were not tested and may also be affected. The vendor did not respond to early notification with details about the vulnerability or the affected version range. The weakness is classified under [CWE-863] (Incorrect Authorization).

Critical Impact

Authenticated low-privileged users can run arbitrary SQL statements against the backend database, exposing model data, configuration, and stored credentials, and enabling tampering with repository contents.

Affected Products

• Sparx Systems Pro Cloud Server 6.1 (build 167)
• Sparx Systems Pro Cloud Server versions prior to 6.1 (build 167)
• Untested Pro Cloud Server releases that may share the same code path

Discovery Timeline

• 2026-05-19 - CVE-2026-42096 published to NVD
• 2026-05-19 - Last updated in NVD database

Technical Details for CVE-2026-42096

Vulnerability Analysis

Sparx Pro Cloud Server brokers client requests to the underlying database that hosts Enterprise Architect model repositories. The server is responsible for enforcing access decisions before forwarding query operations to the database. CVE-2026-42096 stems from missing authorization checks on a database communication path exposed to authenticated users.

A low-privileged authenticated client can submit arbitrary SQL statements through this path. The server forwards those statements to the database engine using the service account configured for repository access. The database executes the SQL with the privileges of that service account, which typically holds broad read and write rights across the repository schema.

The practical effect is full data-plane compromise of the repository database from a user account that should only be able to read or edit modeling artifacts according to its assigned role. Confidentiality and integrity of stored content are both impacted. See the CERT Poland advisory and the Efigo technical writeup for protocol-level details.

Root Cause

The root cause is the absence of permission validation between the authenticated session and the database communication handler. The server treats any authenticated session as authorized to issue raw SQL, conflating authentication with authorization. This is a textbook [CWE-863] failure.

Attack Vector

The attack is performed over the network against the Pro Cloud Server endpoint. The attacker must hold valid credentials for any account on the server, including the lowest-privileged role. After authenticating, the attacker submits SQL queries through the affected database communication channel. The queries execute with the privileges of the database user configured by the administrator.

For reproduction details and request structure, see the Sploit.tech analysis. No verified public exploit code is referenced in the advisory beyond the conceptual description.

Detection Methods for CVE-2026-42096

Indicators of Compromise

• Database query logs showing SELECT, INSERT, UPDATE, or DROP statements originating from the Pro Cloud Server service account but referencing tables outside normal repository workflows.
• Authentication events for low-privileged Pro Cloud Server accounts followed shortly by anomalous volumes of database activity.
• Unexpected reads against credential, user, or configuration tables in the repository database.

Detection Strategies

• Enable verbose query logging on the database backend (SQL Server, MySQL, PostgreSQL, or Oracle) and baseline normal Pro Cloud Server query patterns.
• Correlate Pro Cloud Server application logs with database audit logs to attribute SQL statements to the originating authenticated user session.
• Alert on SQL statements containing schema enumeration patterns such as information_schema access from the PCS service account.

Monitoring Recommendations

• Monitor outbound connections from the Pro Cloud Server host to identify exfiltration following anomalous database reads.
• Track failed and successful authentication attempts against the PCS web and SOAP endpoints, focusing on accounts with limited modeling privileges.
• Forward PCS and database logs to a centralized analytics platform and apply detections for query patterns that fall outside legitimate Enterprise Architect client behavior.

How to Mitigate CVE-2026-42096

Immediate Actions Required

• Inventory all Sparx Pro Cloud Server deployments and confirm the running build, treating 6.1 (build 167) and earlier as vulnerable.
• Restrict network access to Pro Cloud Server endpoints so that only trusted, authenticated clients can reach the service.
• Audit Pro Cloud Server accounts and disable or rotate credentials for any account that does not require active access.
• Reduce the database privileges granted to the Pro Cloud Server service account to the minimum required for repository operations.

Patch Information

The vendor did not provide details about a fixed version or the full vulnerable range at the time of disclosure. Administrators should consult the Sparx Systems Pro Cloud Server product page for current release notes and apply any newer build that explicitly addresses CVE-2026-42096. Until a confirmed patched build is available, treat all deployments as exposed and rely on compensating controls.

Workarounds

• Place Pro Cloud Server behind a VPN or zero-trust network access layer to eliminate exposure to untrusted networks.
• Configure the backend database user used by PCS with the least privileges required, removing rights to system tables and unrelated schemas.
• Segment the database host so that the PCS service account cannot reach other databases on the same engine.
• Increase log retention on both PCS and the database to support forensic review if exploitation is suspected.

# Example: restrict PCS database account privileges (MySQL syntax)
REVOKE ALL PRIVILEGES ON *.* FROM 'pcs_service'@'pcs_host';
GRANT SELECT, INSERT, UPDATE, DELETE ON ea_repository.* TO 'pcs_service'@'pcs_host';
FLUSH PRIVILEGES;