Helical Insight CVE-2026-111634

Exploitation requires an authenticated session at the 'viewer' privilege level or higher and the ability to invoke the /executeDatasource endpoint with report parameters. The attacker must supply crafted Numeric or String placeholder values in report parameters that evade the application's broken SqlDetect input filter; success depends on that guard being the only sanitization in place (true through version 7.0.0). Impact is bounded by the privileges of the report's configured data-source database account. The principal limiting factor is the authentication requirement (PR:L) - this cannot be exploited by fully unauthenticated attackers - while no user interaction, no special non-default configuration, and no local access are needed once authenticated.

This is a credible, actionable priority rather than a CVSS-inflated non-issue, but with a meaningful limiting factor. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N) scores 8.6 and is internally consistent with the description: a network-reachable endpoint (/executeDatasource), low attack complexity, no user interaction, and high confidentiality and integrity impact from reading unexposed tables and modifying data. The key gating signal is PR:L - exploitation requires an authenticated account (described as a low-privilege 'viewer'), so this is not a pre-auth internet-wide mass-exploitation candidate. No EPSS score was provided, so exploitation probability cannot be quantified. The CVE is NOT listed in CISA KEV and no POC flag was supplied in the input, so there is no evidence of active exploitation; however, a public technical write-up (hackmd) and the exact vulnerable source location (EfwdQueryProcessor.java L220-235) are referenced, which materially lowers the barrier to developing a working exploit. No SSVC decision data was provided. Net: a high-severity, low-complexity authenticated SQLi in a BI tool - real and worth patching promptly for any exposed instance, but the authenticated prerequisite argues against emergency/zero-day treatment absent evidence of exploitation.

A low-privileged authenticated viewer in Helical Insight submits a report execution request to /executeDatasource, supplying a crafted Numeric or String placeholder value that defeats the flawed SqlDetect guard. The injected SQL executes against the report's backing data source, letting the attacker read tables never exposed through the UI and alter stored data. No public exploit code is flagged in the input, but a technical write-up and the exact vulnerable code path are publicly referenced, easing exploit development.