This vulnerability in Tencent APIJSON (version 7.1.0) arises from improper neutralization of special elements used in SQL commands (CWE-89). The AbstractSQLConfig.java component of the APIJSONORM library enforces per-role allow-list checks only on the String form of the @having operator, but not on the Map form. This oversight allows unauthenticated attackers to inject raw SQL fragments via the Map-form @having operator, bypassing access controls configured with get:[] (which normally restricts table reads to no roles). Consequently, attackers can read arbitrary database tables without authentication.

An unauthenticated remote attacker can exploit this vulnerability to bypass per-table access controls and read any database tables, including those explicitly configured to deny access to all roles. This leads to a complete confidentiality breach of the affected database. The CVSS v3.1 score of 9.8 reflects critical impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch information is currently available. Until a patch is released, restrict access to the APIJSON service and monitor for suspicious activity related to the @having operator usage. Avoid exposing the vulnerable version (7.1.0) to untrusted networks.