CVE-2025-15597
A vulnerability has been found in Dataease SQLBot up to 1.4.0.
Does this matter?
Lower severity and a low EPSS score (0.57%). Track it; it rarely justifies an emergency change on its own.
Description
A vulnerability has been found in Dataease SQLBot up to 1.4.0. This affects an unknown function of the file backend/apps/system/api/assistant.py of the component API Endpoint. Such manipulation leads to improper access controls. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.5.0 mitigates this issue. The name of the patch is d640ac31d1ce64ce90e06cf7081163915c9fc28c. Upgrading the affected component is recommended. Multiple endpoints are affected. The vendor was contacted early about this disclosure.
- CVSS 4.0
- 2.1 LOWCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
- EPSS
- 0.57% probability · 47th percentile
- Public exploits
- None in Exploit-DB
- CISA KEV
- Not listed
- Weakness
- CWE-266, CWE-284
- Affected
- fit2cloud/sqlbot
- Source
- cna@vuldb.com
EPSS 0.6% since 26 October 2026; no change recorded yet. Points are recorded when the score first appears and whenever it moves by a percentage point or more.
References
- https://github.com/dataease/SQLBot/Product
- https://github.com/dataease/SQLBot/commit/d640ac31d1ce64ce90e06cf7081163915c9fc28cPatch
- https://github.com/dataease/SQLBot/releases/tag/v1.5.0Release Notes
- https://github.com/dataease/SQLBot/security/advisories/GHSA-h4xm-3q3p-5g6rExploit, Vendor Advisory
- https://github.com/yaowenxiao721/Poc/blob/main/SQLBot/SQLBot-AIModel-Management-Missing-Authorization.mdExploit, Third Party Advisory
- https://github.com/yaowenxiao721/Poc/blob/main/SQLBot/SQLBot-User-Management-Broken-Access-Control.mdExploit, Third Party Advisory
- https://vuldb.com/?ctiid.348291Permissions Required, VDB Entry
- https://vuldb.com/?id.348291Third Party Advisory, VDB Entry
- https://vuldb.com/?submit.706144Third Party Advisory, VDB Entry
- https://vuldb.com/?submit.707283Third Party Advisory, VDB Entry
- https://vuldb.com/?submit.707284Third Party Advisory, VDB Entry
- https://vuldb.com/?submit.707285Third Party Advisory, VDB Entry
- https://vuldb.com/?submit.707286Third Party Advisory, VDB Entry
- https://vuldb.com/?submit.707288Third Party Advisory, VDB Entry
- https://vuldb.com/?submit.707293Third Party Advisory, VDB Entry
- https://vuldb.com/?submit.707294Third Party Advisory, VDB Entry
- https://vuldb.com/?submit.707295Third Party Advisory, VDB Entry
Source: NVD record, EPSS from FIRST.org, KEV from CISA, exploits from Exploit-DB. Refreshed daily. Download this record as JSON.