What is the CVSS score of CVE-2026-31069?

CVE-2026-31069 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of BillaBear are affected by CVE-2026-31069?

BillaBear contains a SQL injection vulnerability exploitable by authenticated account managers, with publicly available technical documentation describing the attack vector.

How to fix or mitigate CVE-2026-31069?

24 hours: Audit all BillaBear deployments; restrict ROLE_ACCOUNT_MANAGER access to only essential personnel; disable account manager module access if operationally feasible. 7 days: Implement database activity monitoring with anomaly detection; enforce multi-factor authentication for account manager accounts; apply network-level restrictions to database access. 30 days: Contact BillaBear vendor for patch release timeline; if no patch released within 90 days, develop and execute migration to alternative billing solution.

BillaBear CVE-2026-31069

EUVD-2026-30946 HIGH

SQL Injection (CWE-89)

2026-05-19 mitre

GHSA-xp6r-8pcc-xv5p

SQLi N A

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 20, 2026 - 14:22 vuln.today

CVSS changed

May 20, 2026 - 14:22 NVD

8.8 (HIGH)

CVE Published

May 19, 2026 - 00:00 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

BillaBear (all versions prior to Jan 2026) contains a SQL Injection vulnerability in the EventRepository. User-controlled input from metric filter names and aggregation properties is directly interpolated into SQL queries using sprintf() without proper sanitization or identifier quoting. Although filter values are parameterized, the filter identifiers (keys) are not. An authenticated attacker with ROLE_ACCOUNT_MANAGER permissions can exploit this to execute arbitrary SQL commands.

AnalysisAI

SQL injection in BillaBear (all versions prior to January 2026) allows authenticated users holding the ROLE_ACCOUNT_MANAGER role to execute arbitrary SQL commands via the EventRepository component. The flaw stems from unsanitized filter identifier keys being concatenated into queries through sprintf(), and while no public exploit identified at time of analysis is listed in KEV, two CVE-referenced gists suggest detailed technical write-ups are publicly available. EPSS is very low (0.01%), but the high CVSS of 8.8 and clear exploitation path make this a meaningful risk for any deployed instance.

Technical ContextAI

BillaBear is an open-source subscription billing and customer management platform (github.com/BillaBear/billabear). The vulnerability is a classic CWE-89 (SQL Injection) in the EventRepository class responsible for handling metric aggregation queries. While the developers correctly parameterized filter VALUES, they used sprintf() to interpolate filter IDENTIFIERS (column names / aggregation keys) directly into the SQL string - a common oversight because prepared statements cannot bind identifiers, requiring explicit allowlisting or quoting that was not implemented. The CPE data is unhelpful here (listed as 'n/a:n/a'), so identification relies on the vendor's GitHub repository rather than NVD's normalized product dictionary.

RemediationAI

Upgrade to a BillaBear release dated January 2026 or later that includes the EventRepository fix; consult https://github.com/BillaBear/billabear for the exact patched commit and tagged release, as a specific fix version is not independently confirmed in the available input data. As a compensating control until patching, restrict who may hold the ROLE_ACCOUNT_MANAGER role to a minimum trusted set, since this role is the exploitation prerequisite - note the trade-off that this limits legitimate administrative delegation. Additional defense-in-depth includes placing the BillaBear admin interface behind VPN or IP allowlisting to reduce the attacker pool, and ensuring the database account used by BillaBear has least-privilege (no FILE, no cross-database access) to limit the blast radius of a successful injection, accepting that this does not prevent data theft from BillaBear's own schema.