Live › vulnerability › CVE-2026-111390
Go to dashboardErupt through version 2.3.0 fails to escape quotes in the linkTreeVal parameter of its table data API, so the value is built into an HQL query. An authenticated user with query permission can inject clauses that bypass tree-scoped filters and read data from other mapped entities.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Applications that run Erupt up to and including 2.3.0 and expose its POST /erupt-api/data/table/{erupt} endpoint to users with query permission on entities that use String-keyed linkTree targets. Deployments without linkTree-scoped data, or where only trusted staff hold query permission, have much lower exposure.
No product ranges from the sources yet.
erupt artifact in pom.xml or build.gradle); versions up to and including 2.3.0 are listed as affected.linkTree configurations with String-keyed targets on entities that users can query.2.3.0; the sources do not name the fixed version, so check the project's release page.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Erupt through 2.3.0 contains an HQL injection vulnerability that allows authenticated users to bypass tree-scoped data filters by injecting unescaped quotes into the linkTreeVal parameter of POST /erupt-api/data/table/{erupt}. Attackers holding query permission on entities with String-keyed linkTree targets can append always-true OR clauses or boolean subqueries to read data from other mapped entities.
This page as .md · .json · in your agent: get_signal("CVE-2026-111390")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.