Monitor vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
5.3
Dataease SQLBot: Unsecured Access to API Endpoint
CVE-2025-15597
Summary
An outdated version of Dataease SQLBot (up to 1.4.0) allows a hacker to access parts of the system they shouldn't have access to, potentially from anywhere. This is a security risk and should be addressed by upgrading to the latest version (1.5.0) to prevent unauthorized access. If you haven't already, update Dataease SQLBot to the latest version as soon as possible.
What to do
No fix is available yet. Check with your software vendor for updates.
Affected software
| Vendor | Product | Affected versions | Fix available |
|---|---|---|---|
| fit2cloud | sqlbot | <= 1.5.0 | – |
Original title
A vulnerability has been found in Dataease SQLBot up to 1.4.0. This affects an unknown function of the file backend/apps/system/api/assistant.py of the component API Endpoint. Such manipulation lea...
Original description
A vulnerability has been found in Dataease SQLBot up to 1.4.0. This affects an unknown function of the file backend/apps/system/api/assistant.py of the component API Endpoint. Such manipulation leads to improper access controls. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.5.0 mitigates this issue. The name of the patch is d640ac31d1ce64ce90e06cf7081163915c9fc28c. Upgrading the affected component is recommended. Multiple endpoints are affected. The vendor was contacted early about this disclosure.
nvd CVSS2.0
6.5
nvd CVSS3.1
6.3
nvd CVSS4.0
5.3
Vulnerability type
CWE-266
Incorrect Privilege Assignment
CWE-284
Improper Access Control
- https://github.com/dataease/SQLBot/ Product
- https://github.com/dataease/SQLBot/commit/d640ac31d1ce64ce90e06cf7081163915c9fc2... Patch
- https://github.com/dataease/SQLBot/releases/tag/v1.5.0 Release Notes
- https://github.com/dataease/SQLBot/security/advisories/GHSA-h4xm-3q3p-5g6r Exploit Vendor Advisory
- https://github.com/yaowenxiao721/Poc/blob/main/SQLBot/SQLBot-AIModel-Management-... Exploit Third Party Advisory
- https://github.com/yaowenxiao721/Poc/blob/main/SQLBot/SQLBot-User-Management-Bro... Exploit Third Party Advisory
- https://vuldb.com/?ctiid.348291 Permissions Required VDB Entry
- https://vuldb.com/?id.348291 Third Party Advisory VDB Entry
- https://vuldb.com/?submit.706144 Third Party Advisory VDB Entry
- https://vuldb.com/?submit.707283 Third Party Advisory VDB Entry
- https://vuldb.com/?submit.707284 Third Party Advisory VDB Entry
- https://vuldb.com/?submit.707285 Third Party Advisory VDB Entry
- https://vuldb.com/?submit.707286 Third Party Advisory VDB Entry
- https://vuldb.com/?submit.707288 Third Party Advisory VDB Entry
- https://vuldb.com/?submit.707293 Third Party Advisory VDB Entry
- https://vuldb.com/?submit.707294 Third Party Advisory VDB Entry
- https://vuldb.com/?submit.707295 Third Party Advisory VDB Entry
Published: 2 Mar 2026 · Updated: 13 Mar 2026 · First seen: 6 Mar 2026