EUVD-2026-30927
GHSA-544c-gfhm-rwqf
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privileged PCS credentials
-
DeliveryConnect to Pro Cloud Server over network
-
ExploitSubmit arbitrary SQL via model channel
-
ExecutionServer forwards query without authorization check
-
PersistDatabase executes under service account
-
ImpactExfiltrate or modify model and ACL data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization logic validation
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network reachability to the Sparx Pro Cloud Server listener and any valid low-privileged Pro Cloud Server user account (CVSS PR:L), with no user interaction and no special attack requirements (AT:N, UI:N). The flaw is present in the default database-communication path of Pro Cloud Server 6.1 build 167 and earlier - no non-default configuration toggle is needed - and the database service account must have meaningful privileges for the attacker to derive value (typical deployments grant broad schema access, so this is rarely a real limit). Limiting factors are the authentication requirement and whether the Pro Cloud Server port is exposed beyond the modeling user population; internet-exposed instances dramatically widen the attacker pool. |
| Impact | CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L) gives an 8.7 High rating driven by network reach, low attack complexity, no user interaction, and high confidentiality and integrity impact, with PR:L indicating authentication is required. CERT-PL coordinated disclosure plus two independent technical write-ups (sploit.tech and efigo.pl) constitute a credible roadmap for exploitation even though no weaponized POC is yet catalogued, and the EUVD listing reinforces the upper bound at version 6.1. The vendor's failure to respond to coordinated disclosure is a notable risk amplifier - defenders cannot rely on a confirmed-fixed version, and untested newer builds may also be vulnerable. EPSS, CISA KEV, and SSVC data were not supplied; absence of KEV listing should not be read as evidence of safety given the recent (May 2026) disclosure window. |
| Exploit ScenarioDerived | An attacker who has obtained any low-privileged Pro Cloud Server account - for example a contractor or compromised employee credential - connects to the server over the network and issues SQL statements through the model communication channel. Because the server skips permission checks, the queries execute under the database service account, letting the attacker exfiltrate other tenants' models, modify access-control tables, or pivot to any other database the service account can reach on the same instance. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – May 19, 2026
Broken access control in Sparx Systems Pro Cloud Server 6.1 (build 167) and earlier allows authenticated low-privileged users to execute arbitrary SQL queries against the backend database with the database user's privileges. The flaw stems from missing permission checks in the database communication layer, effectively granting any logged-in user the ability to read or modify any data the service account can access. No public exploit identified at time of analysis, but technical write-ups have been published by CERT-PL and independent researchers.
RemediationAI
No vendor-released patch identified at time of analysis - Sparx Systems did not respond to CERT-PL's coordinated disclosure with a fix version or vulnerable-range confirmation, so administrators should contact Sparx Systems directly to obtain a remediated build and consult the CERT-PL advisory at https://cert.pl/en/posts/2026/05/CVE-2026-42096 for updates. As compensating controls, restrict network reachability of the Pro Cloud Server listener (default TCP ports for the model server) to trusted modeler workstations via firewall ACLs or VPN segmentation, since exploitation requires authenticated network access; aggressively prune Pro Cloud Server user accounts to remove inactive or low-trust principals; and reduce the privileges of the database service account used by Pro Cloud Server to the minimum required schema (drop CREATE/ALTER/DROP and cross-database SELECT where possible), accepting that some modeling features that mutate schema may break. Additional context is available in the third-party analyses at https://sploit.tech/2026/05/19/Sparx-Enterprise-Architect-PCS.html and https://efigo.pl/blog/CVE-2026-42096/.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Sparx Pro Cloud Server is the multi-user collaboration backend for Sparx Enterprise Architect, brokering access between modeling clients and a backing relational database (typically SQL Server, MySQL, PostgreSQL, or Oracle). The vulnerability is classified as CWE-863 (Incorrect Authorization): the server exposes a database communication channel that accepts SQL statements from clients, but fails to verify whether the authenticated client has the role required to issue those statements. As a result, queries are forwarded to the database under the service's connection identity, which generally holds broad DDL/DML rights across the modeling schema and possibly other databases hosted on the same instance.
Know when Pro Cloud Server gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N
Primary rating from Vendor (CERT-PL) · only source for this CVE.
CVSS VectorVendor: CERT-PL
DescriptionCVE.org
Sparx Pro Cloud Server is vulnerable to Broken Access Control within communication with the database. Due to lack of permission checks, any low privileged user can run arbitrary SQL queries within database user context.
The vendor was notified early about this vulnerability, but didn't respond with the details of vulnerability or vulnerable version range. Only version 6.1 (build 167) and below were tested and confirmed as vulnerable, other versions were not tested and might also be vulnerable.
Executive ViewAI
Sparx Systems Pro Cloud Server versions 6.1 (build 167) and earlier contain a privilege escalation vulnerability allowing authenticated users to execute arbitrary SQL queries with database service account privileges, effectively bypassing all role-based access controls. This exposes organizations to high-risk data breach scenarios where internal users can access or modify sensitive business information. Without vendor patches available, mitigation requires immediate compensating controls.
No vendor-released patch identified at time of analysis. Required interim controls: network-based database access restrictions (firewall/NSG rules); implementation of database activity monitoring with real-time alerting; enforcement of least-privilege access for application service accounts; weekly audit logs for unauthorized data access; network segmentation isolating Sparx Systems deployment from critical business systems.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Pro Cloud Server
View allUnauthenticated SQL execution affects Sparx Pro Cloud Server when attackers omit the 'model' query parameter from the UR
Remote code execution in Sparx Systems Pro Cloud Server (versions 0 through 6.1 build 167) is achievable by authenticate
Denial of service in Sparx Systems Pro Cloud Server 6.1 (build 167) and earlier allows authenticated remote attackers to
Exploit-DB