Helical Insight through 7.0.0 contains an sql injection vulnerability that allows authenticated viewers to inject SQL through unescaped report… (CVE-2026-111634)

CVE-2026-111634 describes an SQL injection vulnerability in Helical Insight up to version 7.0.0. Authenticated viewers can inject SQL commands through crafted Numeric or String placeholder values in report parameters sent to the /executeDatasource endpoint. The vulnerability arises because the input is not properly escaped and the existing SqlDetect guard can be bypassed. This allows attackers to access unexposed database tables and modify data within the report's data source.

Successful exploitation can lead to unauthorized disclosure of sensitive data and unauthorized modification of data in the underlying data source. The CVSS 3.1 score of 8.1 (high) reflects the network attack vector, low attack complexity, required privileges (authenticated user), no user interaction, and high confidentiality and integrity impact with no availability impact.

No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to authenticated users with minimal privileges and monitor for suspicious activity related to report parameter usage.