---
id: "CVE-2026-113405"
kind: "vulnerability"
aliases: ["CVE-2026-113405"]
title: "BA-Workflow: SQL injection lets logged-in users read, change, delete data"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "BA-Workflow", "fixed": ["3.6.2.7"], "affected": "< 3.6", "ecosystem": "vendor"}]
ecosystems: []
tags: ["authenticated", "ba-workflow", "other", "self-hosted", "sql-injection", "ys-infoware"]
not_affected_if: ["auth-required", "no-ba-workflow-installed"]
published_at: "2026-10-20T08:16:42+00:00"
first_seen_at: "2026-10-23T21:57:20+00:00"
updated_at: "2026-10-24T00:18:06+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-113405", "first_seen_at": "2026-10-23T21:57:20+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-24T00:18:06+00:00"}]
---

# BA-Workflow: SQL injection lets logged-in users read, change, delete data

BA-Workflow (YS-infoware) before v3.6 has an SQL injection (CWE-89) that any logged-in user can use over the network to read, modify or delete database contents. CVSS 4.0 8.7 / 3.1 8.8. Reported by YuCheng Lin (Chtsecurity), published 2026-10-20 by TWCERT/CC. The vulnerable endpoint is not public. No known exploitation or public PoC.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:BA-Workflow affected < 3.6 fixed 3.6.2.7

## How to check

Check your installed BA-Workflow version in the product's admin or about page. Anything below v3.6.2.7 should be treated as exposed. The advisory lists CVE-2026-113405 as affecting versions before v3.6, but the vendor fix is v3.6.2.7. Check whether the app is reachable from the internet or untrusted networks, since any login is enough to exploit it.

## Fix

Update BA-Workflow to v3.6.2.7 or later (TWCERT/CC solution). Until then, limit access to the app to trusted networks and review accounts that can log in.

## Timeline

- 2026-10-23T21:57:20+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-113405
- 2026-10-24T00:18:06+00:00 analyst — Read TWCERT/CC TVN-202610007 (primary CNA advisory) and CVE record. Affected <v3.6 per CVE; advisory solution says update to v3.6.2.7 or later (sibling CVE-2026-113407 is <3.6.2.7). Endpoint not disclosed. No exploitation or PoC found; social search skipped (niche Taiwanese product). Siblings CVE-2026-113406/113407 same advisory.

## Documents

- [advisory] TWCERT/CC TVN-202610007: YS-infoware BA-Workflow - 3 Vulnerabilities https://www.twcert.org.tw/en/cp-139-11299-0cbfd-2.html
- [mentions] CVE Record: CVE-2026-113405 https://www.cve.org/CVERecord?id=CVE-2026-113405

## From the sources

BA-Workflow developed by YS-infoware has a SQL Injection vulnerability. Authenticated remote attackers can inject arbitrary SQL statements to read, modify, and delete database contents.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_