CVE-2026-72565: Tencent APIJSON SQLi Vulnerability

CVE-2026-72565 Overview

CVE-2026-72565 is a SQL injection vulnerability in Tencent APIJSON through version 8.1.8. The flaw resides in the handling of the Map-form @having operator within the ORM layer. Unauthenticated remote attackers can inject SQL syntax through this operator to bypass per-table access control and read arbitrary database tables. APIJSON is an ORM library widely used to auto-generate REST/JSON APIs from database schemas, so the impact extends to any application exposing its endpoints to untrusted clients.

Critical Impact
Unauthenticated remote attackers can read arbitrary database tables, bypassing APIJSON's per-table access control model.

Affected Products

Tencent APIJSON versions up to and including 8.1.8
APIJSONORM component (AbstractSQLConfig.java)
Applications embedding APIJSON as their API/ORM layer

Discovery Timeline

2026-08-10 - CVE-2026-72565 published to NVD
2026-08-10 - Last updated in NVD database

Technical Details for CVE-2026-72565

Vulnerability Analysis

APIJSON accepts JSON request bodies that describe database queries. The @having operator maps to the SQL HAVING clause used for filtering aggregated results. When @having is supplied in Map form, APIJSON does not adequately validate or parameterize the supplied expression before concatenating it into the generated SQL statement.

The generated SQL is executed with the privileges of the backend database user configured in APIJSON. Because APIJSON enforces its per-table access control at the request-parsing layer, an attacker who injects raw SQL through @having sidesteps those checks entirely. Sub-selects and UNION constructs can then read tables that were never exposed by the API definition.

The weakness is classified as [CWE-89] Improper Neutralization of Special Elements used in an SQL Command.

Root Cause

The root cause lies in AbstractSQLConfig.java, where Map-form @having values are converted to SQL fragments without enforcing the same operator, function, and identifier allow-listing applied to other query constructs. User-controlled keys and values pass through to the final statement, allowing arbitrary SQL to be appended to the HAVING clause.

Attack Vector

Exploitation requires only network access to an APIJSON endpoint. The attacker sends a crafted JSON request containing a Map-form @having clause whose values include SQL metacharacters, sub-selects, or UNION statements. The backend concatenates the payload into the query, executes it, and returns the resulting rows in the API response. No authentication or user interaction is required.

Technical details are available in the APIJSON repository and the APIJSONORM source code.

Detection Methods for CVE-2026-72565

Indicators of Compromise

HTTP POST requests to APIJSON endpoints containing @having keys with SQL keywords such as SELECT, UNION, --, /*, or information_schema
Database query logs showing HAVING clauses that reference tables not declared in the corresponding APIJSON access-control configuration
Anomalous outbound response sizes from APIJSON endpoints, indicating bulk data return
Application logs containing SQL syntax errors originating from the @having parameter

Detection Strategies

Inspect JSON request bodies at the WAF or API gateway for @having values containing SQL metacharacters or nested query syntax
Enable database audit logging and correlate executed statements to the originating APIJSON request identifiers
Alert on API responses that return columns or tables not permitted by the APIJSON Access configuration

Monitoring Recommendations

Capture full request bodies for APIJSON endpoints in centralized logging rather than URI-only logging
Baseline normal HAVING clause patterns per endpoint and alert on deviations
Monitor the backend database account used by APIJSON for queries touching sensitive tables outside its expected scope

How to Mitigate CVE-2026-72565

Immediate Actions Required

Inventory all services embedding APIJSON and identify versions at or below 8.1.8
Restrict access to APIJSON endpoints to authenticated internal callers where feasible
Deploy a WAF rule that rejects requests where the @having field contains SQL keywords or comment sequences
Restrict the database account used by APIJSON to the minimum set of tables and columns required

Patch Information

No fixed version is referenced in the NVD entry at time of publication. Monitor the Tencent APIJSON repository for a release above 8.1.8 that addresses the Map-form @having handling in AbstractSQLConfig.java and upgrade as soon as it is available.

Workarounds

Filter or strip the @having key from inbound JSON at an API gateway until a patched release is deployed
Apply strict per-table Access role configuration in APIJSON and disable public roles for sensitive tables
Enforce read-only database credentials scoped to only the tables the API is intended to expose
Place APIJSON behind an authenticated reverse proxy to eliminate unauthenticated network exposure

bash

# Example WAF rule concept: block @having values containing SQL metacharacters
# ModSecurity pseudo-rule
SecRule REQUEST_BODY "@rx \"@having\"\s*:\s*\{[^}]*(union|select|--|/\*|information_schema)" \
    "id:1072565,phase:2,deny,status:403,msg:'APIJSON CVE-2026-72565 @having SQLi attempt'"