PT-2026-41942 · Billabear · Billabear

Published 2026-05-19 · Updated 2026-05-20 · CVE-2026-31069

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions BillaBear versions prior to Jan 2026

Description An issue exists in the EventRepository where user-controlled input from metric filter names and aggregation properties is directly interpolated into SQL queries using the sprintf() function without proper sanitization or identifier quoting. While filter values are parameterized, the filter identifiers (keys) are not. An authenticated attacker with ROLE ACCOUNT MANAGER permissions can exploit this to execute arbitrary SQL commands.

Recommendations Update to a version released in January 2026 or later. As a temporary workaround, restrict the use of the EventRepository or limit the permissions of users with ROLE ACCOUNT MANAGER to minimize the risk of exploitation.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2026-31069

Affected Products

Billabear

References · 5

• 🔥 https://gist.github.com/nedlir/a50725b94650467f0593b8f4009ae19e · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-31069 · Security Note
• https://github.com/BillaBear/billabear · Note
• https://twitter.com/CVEnew/status/2056994218988720255 · Twitter Post
• https://gist.github.com/nedlir/2377ba6e7fa2ad957210b52aa8e400d9 · Note