---
id: "CVE-2026-111634"
kind: "vulnerability"
aliases: ["CVE-2026-111634"]
title: "Helical Insight: SQL injection lets authenticated viewers read and modify data"
severity: "high"
cvss: 8.6
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "helicalinsight", "fixed": [], "affected": "<= 7.0.0", "ecosystem": "vendor"}]
ecosystems: []
tags: ["authenticated", "bi", "helical-insight", "other", "reporting", "self-hosted", "sql", "sql-injection"]
not_affected_if: ["auth-required", "no-untrusted-viewers", "no-viewer-accounts"]
published_at: "2026-10-16T18:17:43+00:00"
first_seen_at: "2026-10-23T21:57:13+00:00"
updated_at: "2026-10-25T03:45:42+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111634", "first_seen_at": "2026-10-23T21:57:13+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-25T03:45:42+00:00"}]
---

# Helical Insight: SQL injection lets authenticated viewers read and modify data

Helical Insight through 7.0.0 builds report SQL by pasting request parameter values into placeholders; the SqlDetect guard checks the wrong JSON key and never runs. Any logged-in viewer can call /executeDatasource to read other tables and modify data in the report's data source. No vendor fix is published yet.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:helicalinsight affected <= 7.0.0 fixed ?

## How to check

Check the installed version (hi-ee-7.0.0.war / Helical Insight <= 7.0.0 is affected). Exposure needs reports whose EFWD query uses ${name} placeholders and any ROLE_VIEWER/USER account able to reach /executeDatasource. Review web logs for /executeDatasource requests with single quotes or SQL tokens in parameter values.

## Fix

No fixed version published as of 2026-10-25; 7.0.0 is the latest release. Until the vendor ships a fix: restrict viewer accounts, put a WAF/reverse-proxy rule on /executeDatasource, and run report data sources with a read-only, least-privilege DB account.

## Timeline

- 2026-10-23T21:57:13+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-111634
- 2026-10-25T03:45:42+00:00 analyst — Read researcher write-up (hackmd), VulnCheck/NVD, GitHub releases. No vendor advisory or fixed version exists; 7.0.0 is the latest release. Root cause: EfwdQueryProcessor concatenates Numeric/String params into SQL on a plain Statement; SqlDetect guard reads JSON path $.@name but key is 'name', so it never runs. No exploitation reported, no public PoC link seen (write-up has illustrative requests). Sibling CVE-2026-111635 (path traversal in /getExternalResource) same product. Nothing marked verified: no vendor words.

## Documents

- [advisory] VulnCheck advisory: Helical Insight through 7.0.0 SQLi https://www.vulncheck.com/advisories/helical-insight-through-7.0.0-sql-injection-via-executedatasource
- [describes] Helical Insight: authenticated SQLi via EFWD report parameters (researcher write-up) https://hackmd.io/@hieuPenguinnn/helicalinsight-efwd-parameter-sqli
- [mentions] Helical Insight releases (7.0.0 latest) https://github.com/helicalinsight/helicalinsight/releases

## From the sources

Helical Insight through 7.0.0 contains an sql injection vulnerability that allows authenticated viewers to inject SQL through unescaped report parameter values sent to /executeDatasource. Attackers can supply crafted Numeric or String placeholder values that bypass the broken SqlDetect guard to read unexposed tables and modify data in the report's data source.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_