Erupt EUVD-2026-102844

Exploitation requires an authenticated Erupt account that holds query permission on at least one entity whose linkTree target is String-keyed; against such entities the attacker injects unescaped quotes into the linkTreeVal parameter of POST /erupt-api/data/table/{erupt}. Limiting factors: valid credentials are mandatory (PR:L), and the specific configuration - a String-keyed linkTree target plus query permission on it - must exist (reflected as AT:P), so default or numeric-keyed deployments without that data model are not exploitable. Impact is limited to reading data from other mapped entities (no write or availability impact).

This is a genuine but moderate-priority issue, best treated as an authorization/data-exposure flaw rather than a critical breach. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N, 6.0 Medium) is internally consistent with the description: network-reachable (AV:N) but requiring low-level authentication (PR:L) and a present attack requirement (AT:P) - namely that the attacker already holds query permission on entities whose linkTree targets use String keys. Impact is confidentiality-only (VC:H, VI:N, VA:N): the HQL injection reads data from other mapped entities but does not write or deny service, which caps real-world severity. No EPSS score, no CISA KEV listing, and no public POC were provided in the input, so exploitation status is 'no public exploit identified at time of analysis.' The absence of EPSS/KEV data is consistent with a recently disclosed, niche-framework bug rather than a contradiction. The main signals agree (authenticated, read-only, condition-gated), so there is no conflict to flag; the principal limiting factor is that exploitation is not possible against arbitrary deployments - it requires both valid credentials and a specific entity/linkTree data-model configuration.

An authenticated low-privilege user with query permission on an Erupt entity whose linkTree target uses a String key sends a crafted POST to /erupt-api/data/table/{erupt} containing unescaped quotes in the linkTreeVal parameter. By appending an always-true OR clause or a boolean subquery, the attacker breaks out of the intended tree-scoped filter and reads rows from other mapped entities they should not see. No public proof-of-concept was identified in the provided data, though a HackMD write-up and VulnCheck advisory are referenced.