{"data":{"id":"d98dc079-cc6f-4032-aa85-981aa47bbe4f","title":"CVE-2026-42463: SQLBot is an intelligent Text-to-SQL system based on large language models and RAG. Prior to 1.8.0, SQLBot contains a…","summary":"CVE-2026-42463 affects SQLBot versions prior to 1.8.0, a Text-to-SQL system built on large language models and RAG. The /api/v1/datasource/exportDsSchema and /api/v1/datasource/uploadDsSchema endpoints contain a Cross-Workspace IDOR and authorization bypass (CWE-639), letting an attacker access and modify database schemas and data sources belonging to other tenants or workspaces. GitHub rates it CVSS 4.0 8.6 (HIGH); NVD has not yet provided an assessment.","solution":"Fixed in 1.8.0.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-42463","publishedAt":"2026-05-13T22:16:43.397Z","cveId":"CVE-2026-42463","cweIds":["CWE-639"],"cvssScore":null,"cvssSeverity":null,"severity":"high","attackType":[],"issueType":"vulnerability","affectedPackages":null,"affectedPackageNames":null,"affectedPackageRefs":null,"affectedVendors":[],"affectedVendorsRaw":["SQLBot"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"SQLBot cross-workspace authorization bypass in export and upload endpoints","headlinePromptVersion":"h1","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.00364,"epssCheckedAt":"2026-10-14T18:05:58.741Z","kevDateAdded":null,"advisoryAliases":null,"affectedPackagesSource":null,"affectedPackagesCheckedAt":"2026-10-10T03:48:22.753Z","patchAvailable":null,"disclosureDate":"2026-05-13T22:16:43.397Z","capecIds":null,"crossRefCount":0,"attackSophistication":"trivial","impactType":["confidentiality","integrity"],"aiComponentTargeted":"api","llmSpecific":true,"classifierConfidence":0.85,"researchCategory":null,"atlasIds":null}}