PT-2026-22545 · Unknown · Dataease Sqlbot

Vuldb + 1 · CVE-2025-15597 · Published 2026-03-02 · Updated 2026-03-05

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Dataease SQLBot versions up to 1.4.0

Description A security issue has been identified in Dataease SQLBot. This issue relates to improper access controls due to manipulation of an unknown function within the file backend/apps/system/api/assistant.py of the API Endpoint component. The attack can be launched remotely. Multiple API endpoints are affected. The exploit is publicly available.

Recommendations Upgrade to version 1.5.0 to resolve this issue.

Exploit

Fix

Improper Access Control

Incorrect Privilege Assignment

Weakness Enumeration

CWE-284

CWE-266

Related Identifiers

CVE-2025-15597

GHSA-H4XM-3Q3P-5G6R

Affected Products

Dataease Sqlbot

References · 26

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/15xxx/CVE-2025-15597.json · Exploit
• 🔥 https://github.com/yaowenxiao721/Poc/blob/main/SQLBot/SQLBot-AIModel-Management-Missing-Authorization.md · Exploit
• 🔥 https://github.com/yaowenxiao721/Poc/blob/main/SQLBot/SQLBot-User-Management-Broken-Access-Control.md · Exploit
• https://github.com/dataease/SQLBot/commit/d640ac31d1ce64ce90e06cf7081163915c9fc28c · Patch
• https://github.com/dataease/SQLBot/security/advisories/GHSA-h4xm-3q3p-5g6r · Vendor Advisory
• https://github.com/dataease/SQLBot/releases/tag/v1.5.0 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-15597 · Security Note
• https://osv.dev/vulnerability/CVE-2025-15597 · Vendor Advisory
• https://github.com/dataease/SQLBot · Note
• https://t.me/cveNotify/153696 · Telegram Post
• https://vuldb.com/?submit.707288 · Note
• https://vuldb.com/?submit.707283 · Note
• https://vuldb.com/?id.348291 · Note
• https://twitter.com/infoflowcloud/status/2028369917754405110 · Twitter Post
• https://vuldb.com/?submit.707285 · Note