An SQL injection vulnerability exists in the get_last_seen code-server session-state RPC in Posit Workbench versions before 2026.08.0. Authenticated users can exploit this flaw to read arbitrary data from the Workbench database using the sessionIds parameter. Exploitation requires a valid authenticated session but does not require administrative privileges. The vulnerability is limited to unauthorized disclosure of database contents.