External risk intelligence

Tencent APIJSON SQL Injection Allows Database Table Reading

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-72565

APIJSON is a framework designed for creating web APIs. As a backend interface, it is commonly deployed as an internet-facing API endpoint to serve data to frontend applications, making it a standard part of the external-facing service architecture.

SQL Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This vulnerability affects the Tencent APIJSON framework, which is used to build web APIs. It allows unauthenticated attackers to bypass access controls and read sensitive database information. The main concern is confirming relevance and exposure to this framework within our environment.

Attackers can read sensitive database data.
Potential for unauthorized access to company information.
Verify if Tencent APIJSON is in use.

Attack Path

How an attacker could exploit the issue

An attacker can exploit this vulnerability by sending a specially crafted request to an exposed Tencent APIJSON endpoint. Because the security check for the "@having" operator is incomplete, the attacker can bypass access restrictions and inject SQL commands. This allows an unauthenticated user to read any data from the database that would otherwise be inaccessible.

Unauthenticated network access required.
Incomplete @having operator check.
Read arbitrary database tables.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow unauthenticated attackers to bypass access controls and read any database table through a flaw in how APIJSON handles certain queries. This occurs because the check for allowed access is not consistently applied to all forms of the "@having" operator, potentially exposing sensitive information when the affected component is used in an internet-facing API.

Arbitrary database tables.
Exploiting flawed query handling.
Unauthorized data access and leakage.

Operational Fix

Recommended remediation, mitigation, and detection steps

The Tencent APIJSON framework's SQL injection vulnerability likely falls under the responsibility of platform or application teams who manage API infrastructure. The immediate first step is to identify all instances of APIJSON, determine their exposure and criticality, and then locate the accountable owner to prioritize remediation.

Application or platform teams own the issue.
Verify APIJSON deployment and exposure.
Plan remediation based on risk assessment.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Tencent APIJSON?

Tencent APIJSON is an ORM (Object-Relational Mapping) framework used by developers to build web APIs automatically. It simplifies database interactions by allowing frontend applications to request data using JSON structures, which the framework translates into SQL queries to interact with backend databases.

Why is this a SQL injection vulnerability?

This vulnerability is classified as CWE-89, or improper neutralization of special elements used in an SQL command. The software fails to sanitize the 'Map-form' of the @having operator, allowing an attacker to inject raw SQL fragments that the database executes unintentionally.

How does an attacker trigger CVE-2026-72565?

An attacker triggers this by sending a specially crafted request using the Map-form of the @having operator to an API endpoint. Importantly, this bug is not triggered when using the String-form of the operator, as the framework correctly applies security allow-list checks to that specific format.

Is my server at risk of this APIJSON issue?

If you host an internet-facing API using this framework, you are at higher risk. According to Halo Surface Signal, APIJSON is typically deployed as a backend interface for frontend applications, which often places these endpoints directly on the public network, making them reachable by remote, unauthenticated users.

What steps should I take if I use APIJSON?

First, inventory your software portfolio to locate all instances where APIJSON is deployed. Once identified, work with your application or platform teams to assess the network exposure of these instances and prioritize applying official updates or vendor-supplied patches as they become available.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.