CVE-2026-31069: SQL Injection

Q: Who can exploit this vulnerability?

An attacker must be authenticated and have ROLE_ACCOUNT_MANAGER permissions. The issue is remotely reachable and does not require user interaction.

Q: Which inputs are vulnerable?

Metric filter names and aggregation properties are vulnerable because they are inserted into SQL queries with sprintf() without sanitization or identifier quoting. Filter values themselves are parameterized.

Q: What is the potential impact?

A successful attacker can execute arbitrary SQL commands, with high confidentiality, integrity, and availability impact according to the provided CVSS vector.

Q: Which versions are affected?

BillaBear versions prior to January 2026 are affected. The provided information does not identify a specific fixed version.

Published May 19, 2026

Updated

BillaBear (all versions prior to Jan 2026) contains a SQL Injection vulnerability in the EventRepository. User-controlled input from metric filter names and aggregation properties is directly interpolated into SQL queries using sprintf() without proper sanitization or identifier quoting. Although filter values are parameterized, the filter identifiers (keys) are not. An authenticated attacker with ROLEACCOUNTMANAGER permissions can exploit this to execute arbitrary SQL commands.

Affected Software

1 affected component

BillaBear BillaBear<2026-01

Event History

May 19, 2026

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Data Sourced

via NVD·04:16 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this vulnerability?

An attacker must be authenticated and have ROLE_ACCOUNT_MANAGER permissions. The issue is remotely reachable and does not require user interaction.

Which inputs are vulnerable?

Metric filter names and aggregation properties are vulnerable because they are inserted into SQL queries with sprintf() without sanitization or identifier quoting. Filter values themselves are parameterized.

What is the potential impact?

A successful attacker can execute arbitrary SQL commands, with high confidentiality, integrity, and availability impact according to the provided CVSS vector.

Which versions are affected?

BillaBear versions prior to January 2026 are affected. The provided information does not identify a specific fixed version.

CVE-2026-31069: SQL Injection

Affected Software

Event History

Frequently Asked Questions

Who can exploit this vulnerability?

Which inputs are vulnerable?

What is the potential impact?

Which versions are affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this vulnerability?

Which inputs are vulnerable?

What is the potential impact?

Which versions are affected?