EUVD-2026-30931
GHSA-hf6p-xc3f-p4f9
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify exposed Pro Cloud Server endpoint
-
DeliveryCraft POST without 'model' URL parameter
-
ExploitEmbed model name and SQL payload in binary body
-
ExecutionBypass URL-based auth check
-
PersistExecute SQL against repository database
-
ImpactExfiltrate model and credential data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Object-level authorization, IDOR prevention
|
| Exploitation Conditions | Exploitation requires only network reachability to a Pro Cloud Server HTTP endpoint and the ability to send a POST request whose URL has no 'model' query parameter while the binary body carries the model name and SQL payload - no credentials, no user interaction, and no non-default configuration are needed (CVSS PR:N/UI:N/AC:L confirms this). The primary limiting factors are network exposure (instances firewalled to internal users or VPNs are not reachable by external attackers) and product version: only Pro Cloud Server 6.1 build 167 and earlier are confirmed vulnerable, with newer builds untested rather than confirmed safe. |
| Impact | CVSS 4.0 of 9.3 with AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L describes a fully remote, unauthenticated, low-complexity attack with high confidentiality and integrity impact and low availability impact - consistent with arbitrary SQL execution against the backing model database. EPSS and CISA KEV are not provided in the input, so probability of mass exploitation and confirmed in-the-wild use cannot be quantified, but a published technical write-up (sploit.tech, efigo.pl) and CERT-PL coordination strongly suggest publicly available exploit code exists. The vendor's non-response on the affected version range is itself a risk signal: defenders cannot determine from public data whether builds above 6.1.167 are patched, partially fixed, or also vulnerable. Treat this as a real and prioritized issue for any internet-exposed Pro Cloud Server, while flagging the version coverage gap. |
| Exploit ScenarioDerived | An attacker reachable on the network sends a POST request to the Pro Cloud Server endpoint with the 'model' query parameter deliberately omitted from the URL, which causes the auth layer to skip credential enforcement; the binary POST body carries the model name and SQL payload, which the backend executes against the target repository database. Because publicly available exploit code exists in the researcher's blog post, opportunistic scanning and data exfiltration from exposed instances is realistic with minimal attacker skill. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – May 19, 2026
Unauthenticated SQL execution affects Sparx Pro Cloud Server when attackers omit the 'model' query parameter from the URL and instead supply the model name inside the binary POST body, bypassing the URL-based authentication check. Version 6.1 (build 167) and earlier are confirmed vulnerable, with broader version coverage unknown because the vendor did not respond to coordinated disclosure by CERT-PL. Publicly available exploit code exists via the researcher's blog write-up, though there is no CISA KEV listing of active in-the-wild exploitation.
RemediationAI
No vendor-released patch identified at time of analysis - Sparx Systems did not respond to CERT-PL coordination and has not published a fixed build. As compensating controls, place Pro Cloud Server behind a reverse proxy or WAF that enforces authentication independently of the application (e.g., require HTTP Basic auth or mTLS at the proxy, which neutralizes the URL-vs-body parsing mismatch), and restrict network exposure of the Pro Cloud Server port to trusted internal networks or VPN clients only - both controls break legitimate anonymous read access if your deployment relied on it. Operators should also monitor POST requests whose URL lacks a 'model' parameter but whose body contains model identifiers, as that pattern matches the bypass. Track the CERT-PL advisory at https://cert.pl/en/posts/2026/05/CVE-2026-42096 and the researcher write-ups at https://sploit.tech/2026/05/19/Sparx-Enterprise-Architect-PCS.html and https://efigo.pl/blog/CVE-2026-42096/ for an eventual vendor fix announcement.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Pro Cloud Server is Sparx Systems' middleware that exposes Enterprise Architect repositories over HTTP for multi-user modeling. Authentication is enforced by parsing the requested URL and the 'model' query parameter to determine which repository the caller is targeting and whether credentials are required. CWE-639 (Authorization Bypass Through User-Controlled Key) applies here because the same identifier (the model name) is accepted from two parallel input channels - the URL query string and a binary blob in the POST body - but the auth layer only inspects the URL channel, while the database layer trusts the POST body channel. The result is a confused-deputy condition where SQL queries derived from the POST body run without the URL-driven auth gate ever firing. The CPE 'cpe:2.3:a:sparx_systems:pro_cloud_server:*:*:*:*:*:*:*:*' covers all builds of the product family.
Know when Pro Cloud Server gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N
Primary rating from Vendor (CERT-PL) · only source for this CVE.
CVSS VectorVendor: CERT-PL
DescriptionCVE.org
Sparx Pro Cloud Server requires authentication based on requested URL. An attacker can omit the "model" query parameter and send the model name only in the binary blob in POST request allowing SQL query execution without authentication.
The vendor was notified early about this vulnerability, but didn't respond with the details of vulnerability or vulnerable version range. Only version 6.1 (build 167) and below were tested and confirmed as vulnerable, other versions were not tested and might also be vulnerable.
Executive ViewAI
Sparx Pro Cloud Server versions 6.1 (build 167) and earlier contain a critical unauthenticated SQL execution vulnerability with publicly available exploit code. Attackers can bypass authentication and directly access the database, creating immediate risk of data compromise across all affected systems. The vendor has not released a patch and declined coordinated disclosure, leaving organizations without official remediation.
No vendor-released patch identified at time of analysis. Interim mitigations include: (1) Network segmentation-restrict Sparx Pro Cloud Server to internal-only networks, enforce VPN for remote access; (2) Web Application Firewall-block POST requests with model parameters in body when URL parameter is absent; (3) Database hardening-restrict user privileges to minimum necessary, rotate credentials, enable query logging with alerts for anomalies; (4) Service isolation-move affected instances to isolated network segments pending patch availability; (5) Continuous monitoring-implement comprehensive access logging and alerting on unusual query patterns or connection sources.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Pro Cloud Server
View allBroken access control in Sparx Systems Pro Cloud Server 6.1 (build 167) and earlier allows authenticated low-privileged
Remote code execution in Sparx Systems Pro Cloud Server (versions 0 through 6.1 build 167) is achievable by authenticate
Denial of service in Sparx Systems Pro Cloud Server 6.1 (build 167) and earlier allows authenticated remote attackers to
Exploit-DB