Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
SQLBot is an intelligent Text-to-SQL system based on large language models and RAG. Prior to 1.8.0, SQLBot contains a Cross-Workspace IDOR (Insecure Direct Object Reference) and Authorization Bypass vulnerability in the /api/v1/datasource/exportDsSchema and /api/v1/datasource/uploadDsSchema endpoints. An attacker can access and modify database schemas and data sources belonging to other tenants/workspaces. This vulnerability is fixed in 1.8.0.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
NONE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-42463 SQLBot is an intelligent Text-to-SQL system based on large language models and RAG. Prior to 1.8.0, SQLBot contains a Cross-Workspace IDOR (Insecure Direct Object Ref… https://www.cve.org/CVERecord?id=CVE-2026-42463
Post summary
The text announces a Cross-Workspace IDOR vulnerability in SQLBot versions before 1.8.0, referencing the CVE record without providing PoC, exploit, or patch details.
CVE-2026-42463 Cross-Workspace IDOR and Authorization Bypass in SQLBot Prior to 1.8.0 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-42463
Post summary
This text announces the existence of CVE-2026-42463, specifying it as a Cross‑Workspace IDOR and Authorization Bypass in SQLBot versions before 1.8.0, without providing PoC, exploit code, or mitigation details.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | fit2cloud | sqlbot | - | - | - |