Executive brief
Sparx Pro Cloud Server, a platform used to host and share Enterprise Architect models, contains a security flaw that allows unauthorized users to bypass authentication. By manipulating how the server identifies the target database model in a web request, an attacker can gain the ability to run arbitrary database commands. This could lead to the theft of sensitive architectural designs, unauthorized modification of project data, or full compromise of the underlying database.
Technical details
Sparx Pro Cloud Server (PCS) exhibits an authorization bypass (CWE-639) due to inconsistent authentication checks based on the requested URL structure. The application typically requires authentication based on the 'model' query parameter; however, an attacker can omit this parameter from the URL and instead include the model name within the binary blob of a POST request. This bypasses the server's authentication gate while still allowing the request to be processed against the target model. Consequently, a remote, unauthenticated attacker can execute arbitrary SQL queries within the context of the database user, leading to full data exfiltration or modification. The vulnerability was confirmed in version 6.1 (build 167) and earlier.
Affected products
- Sparx Systems Pro Cloud Server All versions through 6.1 (build 167)
Timeline
- 2026-05-19: disclosed: Vulnerability disclosed by CERT Polska and sploit.tech
- 2026-05-19: advisory