CVE-2026-72565 Tencent CVE debrief

Who should care

Organizations using Tencent APIJSON, especially those with exposed instances or sensitive data, should prioritize immediate defensive actions. This includes reviewing current deployments, updating access controls, and monitoring for suspicious activity. Security teams and vulnerability management teams should be aware of the potential impact and take steps to mitigate the vulnerability.

Technical summary

CVE-2026-72565 is a critical SQL injection vulnerability in Tencent APIJSON through version 8.1.8. The vulnerability allows unauthenticated remote attackers to bypass per-table access control and read arbitrary database tables via the Map-form @having operator. This could lead to unauthorized data access and manipulation. The CVSS score is 9.8, indicating critical severity. Organizations using Tencent APIJSON through version 8.1.8 should prioritize immediate defensive actions.

Defensive priority

Organizations using Tencent APIJSON through version 8.1.8 should prioritize immediate defensive actions due to the critical severity of this SQL injection vulnerability.

Recommended defensive actions

• Inventory and version checks for Tencent APIJSON
• Implement compensating controls to restrict database access
• Monitor for suspicious database queries
• Apply vendor remediation when available
• Review and update access controls for Tencent APIJSON instances
• Conduct regular security audits to identify potential vulnerabilities
• Engage with Tencent APIJSON support for guidance on mitigating this vulnerability

Evidence notes

Evidence is limited; verify Tencent APIJSON versions 8.1.8 and earlier for SQL injection vulnerability via the Map-form @having operator. Limited evidence suggests that attackers could exploit this vulnerability to bypass per-table access control and read arbitrary database tables. Organizations should verify their deployments and monitor for suspicious activity.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.