A vulnerability in Erupt 2.3.0 permits authenticated users to inject unescaped quotes into the linkTreeVal parameter of the POST /erupt-api/data/table/{erupt} endpoint, enabling them to bypass tree‑scoped data filters. By appending always‑true OR clauses or boolean subqueries, the attacker can read data from other mapped entities that the user normally lacks access to. The flaw stems from an insufficiently sanitized HQL query in the service that processes linkTreeVal. This is a CWE-564 vulnerability.

The vulnerability affects installations of the Erupt framework (erupt:erupt) running version 2.3.0. Only this release contains the unescaped HQL injection; later releases are not affected, so any environment that uses 2.3.0 and has enabled query permissions on entities with string‑keyed linkTree targets is within scope.

The CVSS score is 6.0, indicating moderate severity. The EPSS score is not available, but the attack requires authenticated users with query permissions on entities that employ string‑keyed linkTree targets. This reduces the likelihood of widespread exploitation, and the vulnerability is not listed in the CISA KEV catalog. An attacker would need to craft a POST request to the vulnerable endpoint; therefore, the risk is primarily limited to legitimate users with the necessary permissions. No publicly available exploits have been reported.