{"id":"CVE-2026-111390","kind":"vulnerability","aliases":["CVE-2026-111390"],"related":[],"title":"Erupt: HQL injection lets logged-in users read data outside their tree scope","description":"Erupt through 2.3.0 contains an HQL injection vulnerability that allows authenticated users to bypass tree-scoped data filters by injecting unescaped quotes into the linkTreeVal parameter of POST /erupt-api/data/table/{erupt}. Attackers holding query permission on entities with String-keyed linkTree targets can append always-true OR clauses or boolean subqueries to read data from other mapped entities.","summary":"Erupt through version 2.3.0 fails to escape quotes in the linkTreeVal parameter of its table data API, so the value is built into an HQL query. An authenticated user with query permission can inject clauses that bypass tree-scoped filters and read data from other mapped entities.","severity":"medium","cvss":6.0,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["admin-panels","erupt","java","package","self-hosted"],"not_affected_if":["no-linktree-scoped-data","query-permission-restricted"],"how_to_check":"- Check the Erupt version in the project's dependency file (for example the `erupt` artifact in `pom.xml` or `build.gradle`); versions up to and including `2.3.0` are listed as affected.\n- Look for `linkTree` configurations with String-keyed targets on entities that users can query.","fix":"- Upgrade Erupt to a release newer than `2.3.0`; the sources do not name the fixed version, so check the project's release page.\n- Until patched, restrict query permission on entities that use linkTree filters.","status":"open","published_at":"2026-10-16T12:16:33+00:00","first_seen_at":"2026-10-23T21:57:12+00:00","triaged_at":"2026-10-25T04:05:54+00:00","updated_at":"2026-10-25T04:05:54+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T04:05:54Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Erupt to a release newer than `2.3.0`; the sources do not name the fixed version, so check the project's release page.\n- Until patched, restrict query permission on entities that use linkTree filters.","reach":"internet","title":"Erupt: HQL injection lets logged-in users read data outside their tree scope","impact":"medium","summary":"Erupt through version 2.3.0 fails to escape quotes in the linkTreeVal parameter of its table data API, so the value is built into an HQL query. An authenticated user with query permission can inject clauses that bypass tree-scoped filters and read data from other mapped entities.","category":"package","nicknames":[],"who_cares":["erupt","java","self-hosted","admin-panels"],"confidence":0.6,"needs_auth":"yes","worst_case":"Authenticated user reads data from other mapped entities past tree filters","analyst_note":"Find the fixed Erupt version and the exact upgrade path from the NVD entry or the project's advisory; sources gave no patched version.","how_to_check":"- Check the Erupt version in the project's dependency file (for example the `erupt` artifact in `pom.xml` or `build.gradle`); versions up to and including `2.3.0` are listed as affected.\n- Look for `linkTree` configurations with String-keyed targets on entities that users can query.","needs_analyst":true,"not_affected_if":["no-linktree-scoped-data","query-permission-restricted"],"who_is_affected":"Applications that run Erupt up to and including 2.3.0 and expose its POST /erupt-api/data/table/{erupt} endpoint to users with query permission on entities that use String-keyed linkTree targets. Deployments without linkTree-scoped data, or where only trusted staff hold query permission, have much lower exposure.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000662,"input_tokens":3366,"output_tokens":651,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-111390':17A,20A '-2026':16A,19A '/erupt-api/data/table':107C '2.3.0':33B,80C 'admin':22B 'admin-panel':21B 'allow':87C 'alway':124C 'always-tru':123C 'api':46B 'append':122C 'attack':109C 'authent':57B,88C 'boolean':129C 'built':51B 'bypass':66B,91C 'claus':64B,127C 'contain':81C 'cve':15A,18A 'data':10A,45B,73B,95C,133C 'entiti':77B,114C,137C 'erupt':1A,24B,30B,78C,108C 'escap':36B 'fail':34B 'filter':70B,96C 'hold':110C 'host':29B 'hql':2A,54B,83C 'inject':3A,63B,84C,98C 'java':25B 'key':118C 'let':4A 'linktre':119C 'linktreev':40B,103C 'log':6A 'logged-in':5A 'map':76B,136C 'outsid':11A 'packag':26B 'panel':23B 'paramet':41B,104C 'permiss':61B,112C 'post':106C 'queri':55B,60B,111C 'quot':37B,100C 'read':9A,72B,132C 'scope':14A,69B,94C 'self':28B 'self-host':27B 'string':117C 'string-key':116C 'subqueri':130C 'tabl':44B 'target':120C 'tree':13A,68B,93C 'tree-scop':67B,92C 'true':125C 'unescap':99C 'user':8A,58B,89C 'valu':49B 'version':32B 'vulner':85C","nicknames":[],"mitigations":[],"who_affected":"Applications that run Erupt up to and including 2.3.0 and expose its POST /erupt-api/data/table/{erupt} endpoint to users with query permission on entities that use String-keyed linkTree targets. Deployments without linkTree-scoped data, or where only trusted staff hold query permission, have much lower exposure.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T12:16:33+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111390","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111390","severity":null,"published_at":"2026-10-16T12:16:33+00:00","modified_at":"2026-10-21T03:17:18+00:00","first_seen_at":"2026-10-23T21:57:12+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}