{"id":"CVE-2026-111634","kind":"vulnerability","aliases":["CVE-2026-111634"],"related":[],"title":"Helical Insight: SQL injection lets authenticated viewers read and modify data","description":"Helical Insight through 7.0.0 contains an sql injection vulnerability that allows authenticated viewers to inject SQL through unescaped report parameter values sent to /executeDatasource. Attackers can supply crafted Numeric or String placeholder values that bypass the broken SqlDetect guard to read unexposed tables and modify data in the report's data source.","summary":"Helical Insight through 7.0.0 builds report SQL by pasting request parameter values into placeholders; the SqlDetect guard checks the wrong JSON key and never runs. Any logged-in viewer can call /executeDatasource to read other tables and modify data in the report's data source. No vendor fix is published yet.","severity":"high","cvss":8.6,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"helicalinsight","fixed":[],"affected":"<= 7.0.0","ecosystem":"vendor"}],"ecosystems":[],"tags":["authenticated","bi","helical-insight","other","reporting","self-hosted","sql","sql-injection"],"not_affected_if":["auth-required","no-untrusted-viewers","no-viewer-accounts"],"how_to_check":"Check the installed version (hi-ee-7.0.0.war / Helical Insight <= 7.0.0 is affected). Exposure needs reports whose EFWD query uses ${name} placeholders and any ROLE_VIEWER/USER account able to reach /executeDatasource. Review web logs for /executeDatasource requests with single quotes or SQL tokens in parameter values.","fix":"No fixed version published as of 2026-10-25; 7.0.0 is the latest release. Until the vendor ships a fix: restrict viewer accounts, put a WAF/reverse-proxy rule on /executeDatasource, and run report data sources with a read-only, least-privilege DB account.","status":"open","published_at":"2026-10-16T18:17:43+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","triaged_at":"2026-10-25T03:00:05+00:00","updated_at":"2026-10-25T03:45:42+00:00","category":"other","confidence":0.7,"triage":{"at":"2026-10-25T03:00:05Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Helical Insight: SQL injection lets authenticated viewers read and modify data","impact":"high","summary":"Helical Insight through 7.0.0 does not escape report parameter values sent to /executeDatasource, so crafted Numeric or String placeholders bypass the SqlDetect guard. An authenticated viewer can read tables not exposed in reports and modify data in the report's data source.","category":"other","nicknames":[],"who_cares":["helical-insight","self-hosted","sql","reporting"],"confidence":0.6,"needs_auth":"yes","worst_case":"Attacker reads hidden database tables and modifies report data source.","analyst_note":"Find the vendor's fixed version and advisory for Helical Insight 7.0.0 via the NVD link; the sources give no fix or detection steps.","how_to_check":"- Check the installed Helical Insight version; versions through `7.0.0` are listed as affected.\n- unknown for a specific config file or setting that exposes the endpoint.","needs_analyst":true,"not_affected_if":["auth-required","no-untrusted-viewers"],"who_is_affected":"Teams running Helical Insight up to and including 7.0.0 where users have viewer access to reports that use Numeric or String placeholders. Installations without authenticated viewer accounts exposed to untrusted users have a smaller exposure. The sources do not name a patched version.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000595,"input_tokens":3337,"output_tokens":523,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the vendor's fixed version and advisory for Helical Insight 7.0.0 via the NVD link; the sources give no fix or detection steps.","search":"'-111634':14A,17A '-2026':13A,16A '/executedatasource':65B,108C '7.0.0':36B,88C 'allow':95C 'attack':109C 'authent':6A,19B,96C 'bi':20B 'broken':121C 'build':37B 'bypass':119C 'call':64B 'check':50B 'contain':89C 'craft':112C 'cve':12A,15A 'data':11A,72B,77B,130C,135C 'fix':81B 'guard':49B,123C 'helic':1A,22B,33B,85C 'helical-insight':21B 'helicalinsight':18A 'host':28B 'inject':4A,32B,92C,99C 'insight':2A,23B,34B,86C 'json':53B 'key':54B 'let':5A 'log':60B 'logged-in':59B 'modifi':10A,71B,129C 'never':56B 'numer':113C 'paramet':43B,104C 'past':41B 'placehold':46B,116C 'publish':83B 'read':8A,67B,125C 'report':25B,38B,75B,103C,133C 'request':42B 'run':57B 'self':27B 'self-host':26B 'sent':106C 'sourc':78B,136C 'sql':3A,29B,31B,39B,91C,100C 'sql-inject':30B 'sqldetect':48B,122C 'string':115C 'suppli':111C 'tabl':69B,127C 'unescap':102C 'unexpos':126C 'valu':44B,105C,117C 'vendor':80B 'viewer':7A,62B,97C 'vulner':93C 'wrong':52B 'yet':84B","nicknames":[],"mitigations":[],"who_affected":"Teams running Helical Insight up to and including 7.0.0 where users have viewer access to reports that use Numeric or String placeholders. Installations without authenticated viewer accounts exposed to untrusted users have a smaller exposure. The sources do not name a patched version.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T18:17:43+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111634","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111634","severity":null,"published_at":"2026-10-16T18:17:43+00:00","modified_at":"2026-10-21T21:17:53+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-111634:788","url":null,"severity":null,"published_at":"2026-10-25T03:45:42+00:00","modified_at":"2026-10-25T03:45:42+00:00","first_seen_at":"2026-10-25T03:45:42+00:00","fetched_at":"2026-10-25T03:45:42+00:00","note":"Read researcher write-up (hackmd), VulnCheck/NVD, GitHub releases. No vendor advisory or fixed version exists; 7.0.0 is the latest release. Root cause: EfwdQueryProcessor concatenates Numeric/String params into SQL on a plain Statement; SqlDetect guard reads JSON path $.@name but key is 'name', so it never runs. No exploitation reported, no public PoC link seen (write-up has illustrative requests). Sibling CVE-2026-111635 (path traversal in /getExternalResource) same product. Nothing marked verified: no vendor words."}],"documents":[{"id":3321,"url":"https://hackmd.io/@hieuPenguinnn/helicalinsight-efwd-parameter-sqli","title":"Helical Insight: authenticated SQLi via EFWD report parameters (researcher write-up)","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":3322,"url":"https://www.vulncheck.com/advisories/helical-insight-through-7.0.0-sql-injection-via-executedatasource","title":"VulnCheck advisory: Helical Insight through 7.0.0 SQLi","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":3323,"url":"https://github.com/helicalinsight/helicalinsight/releases","title":"Helical Insight releases (7.0.0 latest)","kind":"release","source":"analyst","text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}