What is the CVSS score of CVE-2026-38158?

CVE-2026-38158 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of UReport are affected by CVE-2026-38158?

UReport v2.2.9 contains a critical SQL injection vulnerability (CVSS 9.8) in the datasource preview endpoint that permits unauthenticated remote attackers to extract arbitrary database contents.

How to fix or mitigate CVE-2026-38158?

Within 24 hours: identify all UReport v2.2.9 instances across your environment, restrict network access to the /ureport/datasource/previewData endpoint to trusted IPs via firewall rules, and enable detailed logging on affected systems. Within 7 days: implement Web Application Firewall rules to block SQL injection patterns targeting this endpoint, audit database account permissions used by UReport and minimize to essential only, and verify database backup and recovery procedures are functional. Within 30 days: escalate vendor contact for patch timeline and security advisory, evaluate alternative reporting solutions with comparable feature sets, and plan comprehensive patching or migration strategy once vendor remediation becomes available.

UReport CVE-2026-38158

CRITICAL

SQL Injection (CWE-89)

2026-07-16 cve@mitre.org

SQLi

9.8

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.2 HIGH

Remote unauthenticated endpoint (AV:N/AC:L/PR:N/UI:N); description scopes impact to data access so C:H, with only incidental write potential (I:L) and no availability impact (A:N).

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 17, 2026 - 14:23 vuln.today

CVSS changed

Jul 17, 2026 - 14:22 NVD

9.8 (CRITICAL)

CVE Published

Jul 16, 2026 - 21:17 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 16, 2026 - 21:17 cve.org

CRITICAL 9.8

DescriptionCVE.org

A SQL injection vulnerability in the /ureport/datasource/previewData component of ureport v2.2.9 allows attackers to access sensitive database information via crafted SQL statements.

AnalysisAI

SQL injection in UReport v2.2.9 lets remote unauthenticated attackers read arbitrary database contents by sending crafted SQL through the /ureport/datasource/previewData endpoint (CWE-89). The endpoint appears to pass user-controlled input into a live datasource preview query without parameterization, exposing sensitive stored data. No public exploit identified at time of analysis, though a technical write-up is published on GitHub; not listed in CISA KEV and no EPSS score was provided.

Technical ContextAI

UReport is an open-source Java/Spring-based web reporting engine (upstream repository youseries/ureport) that lets users design reports and preview data drawn from configured datasources. The vulnerable /ureport/datasource/previewData function is a preview/test feature that executes queries against a datasource; per CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), attacker-supplied input is concatenated into the SQL sent to the backing database rather than bound as parameters, so injected syntax is interpreted as query logic. Because the preview feature is intended to reach a real database connection, a successful injection runs with whatever privileges the configured datasource account holds. No CPE strings were supplied in the input, so exact affected configurations rely on the version string 'v2.2.9' from the description.

Affected ProductsAI

The affected product is UReport version 2.2.9 (upstream project youseries/ureport, https://github.com/youseries/ureport), specifically the /ureport/datasource/previewData component. Only v2.2.9 is named in the source data; earlier versions may also be affected but no version range was provided in the input, and no CPE string was supplied to confirm exact packaging. A technical description of the flaw is available at https://github.com/musesix/cve/blob/main/ureport_sqli/ureport.md.

RemediationAI

No vendor-released patch identified at time of analysis - the references point to the upstream repository (https://github.com/youseries/ureport) and a third-party write-up (https://github.com/musesix/cve/blob/main/ureport_sqli/ureport.md) but do not cite a fixed release version, so upgrade guidance cannot be confirmed; monitor the youseries/ureport releases and issues for a fixed build. As compensating controls: restrict network access to the UReport designer/console so the /ureport/datasource/previewData endpoint is not reachable from untrusted networks (place it behind authentication, a VPN, or an IP allowlist), which fully blocks remote exploitation but prevents legitimate remote report design; disable or block the datasource preview functionality at a reverse proxy by denying requests to the /ureport/datasource/previewData path if the feature is unused, at the cost of losing live data preview; and configure the datasource database account with least privilege (read-only, minimal table scope, no stacked-query/DDL rights) to limit the blast radius of any successful injection, which does not stop disclosure of the data that account can read.