# CVE-2026-72565: Tencent APIJSON SQL injection in @having operator

Source: https://junglewise.ai/threats/cve-2026-72565-tencent-apijson-sql-injection-in-having-operator  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-10. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-72565 · Severity: critical · CVSS 9.8 · Published 2026-08-10

APIJSON is an open-source ORM library that provides a no-code backend API framework. A SQL injection vulnerability in the @having operator allows unauthenticated attackers to bypass table-level access controls and read arbitrary database tables, potentially exposing sensitive customer data, internal records, or operational information.

Vendors: [Tencent](https://junglewise.ai/threats/vendors/tencent).

## Quick answers

**Is CVE-2026-72565 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-72565 being exploited in the wild.

**How severe is CVE-2026-72565?** Critical severity, with a CVSS score of 9.8, published 10 August 2026.

**Which products and versions are affected?** Tencent APIJSON through 8.1.8.

**Is there a fix for CVE-2026-72565?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-72565 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-72565?** Check whether you run Tencent APIJSON at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a SQL injection in the Map-form @having operator that fails to properly sanitize user input before injecting it into SQL queries. An unauthenticated remote attacker can craft a malicious request using the @having parameter to inject arbitrary SQL, bypassing per-table access control mechanisms built into APIJSON. The attack requires no authentication and is network-accessible via the API. An attacker can execute SELECT queries to read data from any database table regardless of configured access restrictions. Patches are expected to be available in versions after 8.1.8.

## Affected products

- Tencent APIJSON through 8.1.8

## Timeline

- 2026-08-10: disclosed

## References

- [https://github.com/Tencent/APIJSON](https://github.com/Tencent/APIJSON)
- [https://github.com/Tencent/APIJSON/blob/master/APIJSONORM/src/main/java/apijson/orm/AbstractSQLConfig.java](https://github.com/Tencent/APIJSON/blob/master/APIJSONORM/src/main/java/apijson/orm/AbstractSQLConfig.java)