PT-2026-22545 · Unknown · Dataease Sqlbot

Vuldb + 1 · Published 2026-03-02 · Updated 2026-03-05 · CVE-2025-15597

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Dataease SQLBot versions up to 1.4.0

Description A security issue has been identified in Dataease SQLBot. This issue relates to improper access controls due to manipulation of an unknown function within the file backend/apps/system/api/assistant.py of the API Endpoint component. The attack can be launched remotely. Multiple API endpoints are affected. The exploit is publicly available.

Recommendations Upgrade to version 1.5.0 to resolve this issue.

Exploit

Fix

Incorrect Privilege Assignment

Improper Access Control

Weakness Enumeration

CWE-266

CWE-284

Related Identifiers

CVE-2025-15597

GHSA-H4XM-3Q3P-5G6R

Affected Products

Dataease Sqlbot

References · 25

• 🔥 https://github.com/yaowenxiao721/Poc/blob/main/SQLBot/SQLBot-AIModel-Management-Missing-Authorization.md · Exploit
• 🔥 https://github.com/yaowenxiao721/Poc/blob/main/SQLBot/SQLBot-User-Management-Broken-Access-Control.md · Exploit
• https://github.com/dataease/SQLBot/commit/d640ac31d1ce64ce90e06cf7081163915c9fc28c · Patch
• https://github.com/dataease/SQLBot/releases/tag/v1.5.0 · Patch
• https://github.com/dataease/SQLBot/security/advisories/GHSA-h4xm-3q3p-5g6r · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-15597 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-15597 · Security Note
• https://t.me/cveNotify/153696 · Telegram Post
• https://vuldb.com/?submit.707283 · Note
• https://github.com/dataease/SQLBot · Note
• https://vuldb.com/?id.348291 · Note
• https://vuldb.com/?submit.707288 · Note
• https://twitter.com/infoflowcloud/status/2028369917754405110 · Twitter Post
• https://vuldb.com/?submit.707285 · Note
• https://vuldb.com/?submit.706144 · Note