PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-31069 BillaBear CVE debrief

CVE-2026-31069 is a high-severity SQL injection in BillaBear's EventRepository. The issue comes from direct interpolation of user-controlled metric filter names and aggregation properties into SQL via sprintf(), while only the filter values are parameterized. Because the identifiers are not sanitized or quoted, an authenticated attacker with ROLE_ACCOUNT_MANAGER access can influence the query structure and potentially execute arbitrary SQL.

Vendor
BillaBear
Product
billabear
CVSS
HIGH 8.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-19
Original CVE updated
2026-07-24
Advisory published
2026-05-19
Advisory updated
2026-07-24

Who should care

BillaBear operators, application owners, and developers who maintain the EventRepository or any query-building code that accepts metric filters or aggregation properties from authenticated users.

Technical summary

The source description says BillaBear versions prior to January 2026 are affected. In EventRepository, metric filter names and aggregation properties are inserted into SQL strings with sprintf() without proper identifier handling. Although the filter values themselves are parameterized, the filter keys are not, which creates a classic CWE-89 SQL injection condition. NVD records the issue as CVSS 3.1 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and maps it to CWE-89.

Defensive priority

High priority. Even though the attack requires authentication and ROLE_ACCOUNT_MANAGER access, the flaw is network-reachable and can expose data, alter records, or disrupt the application through SQL execution. Patch or mitigate before continuing normal use.

Recommended defensive actions

  • Upgrade to the first BillaBear release that includes the January 2026 fix, or a later patched version, if available.
  • Review EventRepository and any similar query builders for sprintf()-based SQL construction that uses user-controlled identifiers.
  • Replace dynamic SQL identifiers with a strict allowlist or fixed mapping to known column names, and apply database-safe identifier quoting where appropriate.
  • Limit ROLE_ACCOUNT_MANAGER membership to the smallest possible set of trusted users and review any delegated access paths.
  • Inspect database and application logs for unexpected query errors, unusual metric-filter activity, or other signs of SQL tampering.

Evidence notes

The CVE description states that user-controlled metric filter names and aggregation properties are directly interpolated into SQL queries using sprintf() without sanitization or identifier quoting, and that ROLE_ACCOUNT_MANAGER users can exploit the flaw. NVD metadata marks the issue as CWE-89, gives it CVSS 3.1 8.8, and shows vulnStatus as Deferred. The referenced project repository is BillaBear/BillaBear, which aligns with the affected component named in the CVE description.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-31069 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-31069

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-31069 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-31069

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.