{"id":"CVE-2026-123087","kind":"vulnerability","aliases":["CVE-2026-123087"],"related":[],"title":"Atmira SIREC: SQL injection through a JSON field lets attackers read database data","description":"SQL injection vulnerability in Atmira’s SIREC. The server retrieves the value of a field from a JSON object containing user-supplied information and concatenates it into an SQL statement without properly sanitising the input. This allows the original query to be altered via malicious input, causing the database to return unexpected information.","summary":"Atmira's SIREC application takes a field from a user-supplied JSON object and concatenates it into an SQL statement without sanitising it. An attacker can alter the query and make the database return information it should not.","severity":"high","cvss":8.7,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"SIREC","fixed":[],"affected":"versions not specified; fixed by vendor 2026-10-16","ecosystem":"vendor"}],"ecosystems":[],"tags":["atmira","auth-required","other","sirec","sql-injection"],"not_affected_if":["patched-after-2026-10-16","unknown"],"how_to_check":"Affected versions are not published. Ask Atmira whether your SIREC build predates the 16 Oct 2026 fix. SIREC is a debt-collection and recovery platform, so check whether your instance is reachable by authenticated users (PR:L) and review database logs for odd SQL from JSON request fields.","fix":"Atmira told INCIBE it fixed the flaw on 16 October 2026; no fixed version number is published. Ask Atmira which build contains the fix.","status":"open","published_at":"2026-11-06T10:16:37+00:00","first_seen_at":"2026-11-06T10:40:57+00:00","triaged_at":"2026-11-06T10:41:11+00:00","updated_at":"2026-11-06T10:42:32+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-11-06T10:41:11Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Atmira SIREC: SQL injection through a JSON field lets attackers read database data","impact":"medium","summary":"Atmira's SIREC application takes a field from a user-supplied JSON object and concatenates it into an SQL statement without sanitising it. An attacker can alter the query and make the database return information it should not.","audience":"businesses","category":"other","nicknames":[],"who_cares":["sirec","atmira","sql-injection"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Attacker reads unexpected database records through altered queries","analyst_note":"Find affected SIREC versions and the vendor's fix from the NVD entry or Atmira's advisory; the description does not name them.","how_to_check":"unknown","plain_action":"","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"Any organisation running Atmira's SIREC application that accepts JSON input from users is potentially exposed. The sources do not name affected versions or say which endpoints take the vulnerable JSON field, so the unknown parts need checking with the vendor.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.00064,"input_tokens":4206,"output_tokens":438,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find affected SIREC versions and the vendor's fix from the NVD entry or Atmira's advisory; the description does not name them.","search":"'-123087':16A,19A '-2026':15A,18A 'allow':103C 'alter':57B,109C 'applic':33B 'atmira':1A,21B,30B,70C 'attack':10A,55B 'auth':23B 'auth-requir':22B 'caus':113C 'concaten':45B,91C 'contain':85C 'cve':14A,17A 'data':13A 'databas':12A,63B,115C 'field':8A,36B,80C 'inform':65B,89C,119C 'inject':4A,29B,67C 'input':101C,112C 'json':7A,42B,83C 'let':9A 'make':61B 'malici':111C 'object':43B,84C 'origin':105C 'proper':98C 'queri':59B,106C 'read':11A 'requir':24B 'retriev':75C 'return':64B,117C 'sanitis':52B,99C 'server':74C 'sirec':2A,20A,26B,32B,72C 'sql':3A,28B,49B,66C,95C 'sql-inject':27B 'statement':50B,96C 'suppli':41B,88C 'take':34B 'unexpect':118C 'user':40B,87C 'user-suppli':39B,86C 'valu':77C 'via':110C 'vulner':68C 'without':51B,97C","nicknames":[],"mitigations":[],"who_affected":"Organisations running Atmira's SIREC (a collections and debt-recovery platform) that were not updated after Atmira's fix of 16 Oct 2026. Exploitation needs network access and a low-privilege login (CVSS 4.0 PR:L). Hosted SIREC customers should confirm with Atmira that the fix is applied.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":["sirec"],"ptokens":["sirec"],"labels":["atmira","authrequired","high","other","sirec","sqlinjection"],"campaign_type":null,"search_a":"'-123087':16A,19A '-2026':15A,18A 'atmira':1A 'attack':10A 'cve':14A,17A 'data':13A 'databas':12A 'field':8A 'inject':4A 'json':7A 'let':9A 'read':11A 'sirec':2A,20A 'sql':3A","search_b":"'alter':57B 'applic':33B 'atmira':21B,30B 'attack':55B 'auth':23B 'auth-requir':22B 'concaten':45B 'databas':63B 'field':36B 'inform':65B 'inject':29B 'json':42B 'make':61B 'object':43B 'queri':59B 'requir':24B 'return':64B 'sanitis':52B 'sirec':26B,32B 'sql':28B,49B 'sql-inject':27B 'statement':50B 'suppli':41B 'take':34B 'user':40B 'user-suppli':39B 'without':51B","search_c":"'allow':103C 'alter':109C 'atmira':70C 'caus':113C 'concaten':91C 'contain':85C 'databas':115C 'field':80C 'inform':89C,119C 'inject':67C 'input':101C,112C 'json':83C 'malici':111C 'object':84C 'origin':105C 'proper':98C 'queri':106C 'retriev':75C 'return':117C 'sanitis':99C 'server':74C 'sirec':72C 'sql':66C,95C 'statement':96C 'suppli':88C 'unexpect':118C 'user':87C 'user-suppli':86C 'valu':77C 'via':110C 'vulner':68C 'without':97C","first_public_at":"2026-11-06T10:16:37+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cve-coordination@incibe.es","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123087","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123087","severity":null,"published_at":"2026-11-06T10:16:37+00:00","modified_at":"2026-11-06T10:16:37+00:00","first_seen_at":"2026-11-06T10:40:57+00:00","fetched_at":"2026-11-06T10:40:57+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-123087:1882","url":"https://www.incibe.es/incibe-cert/alerta-temprana/avisos/inyeccion-sql-en-sirec-de-atmira","severity":null,"published_at":"2026-11-06T10:42:32+00:00","modified_at":"2026-11-06T10:42:32+00:00","first_seen_at":"2026-11-06T10:42:32+00:00","fetched_at":"2026-11-06T10:42:32+00:00","note":"INCIBE-CERT advisory INCIBE-2026-843 (CNA, reporter Luis Ovejero Martin): affected versions not specified; Atmira confirmed fix on 16/10/2026, no version number given. Not verified: INCIBE relays the vendor, no Atmira page found. No exploitation or PoC seen.","cites":["https://www.incibe.es/incibe-cert/alerta-temprana/avisos/inyeccion-sql-en-sirec-de-atmira"]}],"documents":[{"id":85674,"url":"https://www.incibe.es/incibe-cert/alerta-temprana/avisos/inyeccion-sql-en-sirec-de-atmira","title":"INCIBE-2026-843: Inyección SQL en SIREC de Atmira","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}