External risk intelligence

SQL Injection in isquad API Tribuna Endpoint

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-81673

The vulnerability resides in a web application endpoint (/ws/apitribuna/setVisita) designed to receive external requests. Such API endpoints are commonly exposed to the public internet to facilitate web application functionality, making the vulnerable surface reachable from external networks in typical deployment scenarios.

SQL Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability exists in a web application endpoint that handles visit tracking, allowing attackers to manipulate data or cause errors through improper input handling. This could impact the accuracy of analytics and records. The main concern is confirming relevance and exposure to business systems.

Attackers can alter visit tracking data.
Data integrity for analytics is at risk.
Confirm relevance and exposure of this system.

Attack Path

How an attacker could exploit the issue

An attacker can exploit this vulnerability by sending specially crafted requests to the application's `/ws/apitribuna/setVisita` endpoint. No authentication is required, and the attacker can manipulate the `id_video` and `id_ambito` parameters to inject SQL commands. This allows them to disrupt database operations, potentially leading to the corruption or manipulation of visit tracking data and affecting analytics integrity.

No authentication required.
Malicious input in API parameters.
Database errors and data manipulation.

Live Threat

Current exploitation, exposure, and threat context

The '/ws/apitribuna/setVisita' endpoint is vulnerable to SQL injection, which could allow remote attackers to disrupt query execution, cause database errors, and potentially manipulate visit tracking records. This may also impact the integrity of analytics and the accuracy of recorded data.

Visit tracking records at risk.
Unsanitized input allows SQL injection.
Compromised analytics and record integrity.

Operational Fix

Recommended remediation, mitigation, and detection steps

This SQL injection vulnerability in the ‘/ws/apitribuna/setVisita’ endpoint affects applications that track visits or analytics and do not properly sanitize inputs. Application owners and platform teams are primarily responsible for addressing this, requiring coordination with security and potentially vendor management if the affected technology is externally provided. The immediate first step is to identify all instances of this technology, assess their exposure, and confirm business criticality to prioritize remediation efforts.

Application owners must own the issue.
Verify external reachability and business criticality.
Plan remediation based on assessed risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the isquad API Tribuna component?

This software component provides web-based functionality, specifically an endpoint designed to process and record visit tracking data for analytics. It acts as an interface that receives parameters related to video interactions and environmental scopes to maintain accurate usage records within the application ecosystem.

What does CWE-89 mean for CVE-2026-81673?

CWE-89 identifies this vulnerability as an SQL Injection. In plain terms, the application fails to scrub or validate user-provided data before using it in database commands. This allows an attacker to inject their own SQL syntax, tricking the database into running unintended instructions instead of just processing legitimate visit data.

How is CVE-2026-81673 triggered?

An attacker triggers this by sending specially crafted network requests to the specific /ws/apitribuna/setVisita endpoint. They do not need to log in or provide credentials to perform this action. Simply interacting with the id_video or id_ambito parameters with malicious input is sufficient. Legitimate, standard use of these parameters does not cause this issue.

Is my system at risk from this SQL injection?

Halo Surface Signal indicates that because this vulnerability exists within a web API endpoint typically intended for external communication, it is likely reachable from the public internet. Systems that expose this API to outside networks are at higher risk. You should determine if your specific instance is internet-facing or restricted to internal traffic to gauge immediate exposure.

What should I do to secure my environment?

Your first step is to locate all instances of the affected technology within your infrastructure. Once identified, evaluate whether the service must be exposed to the internet and assess its criticality to your business. Coordinate with your security and platform teams to confirm whether you have control over the application code to implement necessary input sanitization or if you need to coordinate with the vendor.

References

www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.