HQL Injection Vulnerability in Erupt Data Management Framework

CVE-2026-111390

What is CVE-2026-111390?

The vulnerability allows authenticated users to bypass tree-scoped data filters within the Erupt Data Management Framework up to version 2.3.0. By injecting unescaped quotes into the 'linkTreeVal' parameter of the POST request to /erupt-api/data/table/{erupt}, attackers with query permissions can manipulate queries by appending always-true OR clauses or boolean subqueries. This risk enables unauthorized data access from other mapped entities, posing a significant threat to data integrity and confidentiality.

References