The vulnerability resides in the /executeDatasource endpoint of Helical Insight. It allows an authenticated viewer to insert malicious SQL by supplying specially crafted Numeric or String placeholder values. Those values bypass the application's SqlDetect guard, leaving them unescaped before execution. An attacker can therefore read data from tables not intended for that viewer and, in some cases, modify or delete rows in the underlying data source. The flaw is a classic SQL injection (CWE-89) that compromises confidentiality, integrity, and potentially availability of business data.

Helical Insight Enterprise Edition, version 7.0.0 and earlier, is affected. Any deployment that exposes the /executeDatasource API to authenticated users without proper input sanitisation is vulnerable. The vulnerability does not depend on product configuration beyond the presence of the free‑facing API.

The CVSS score of 8.6 classifies this flaw as high severity. Although the EPSS score is not published, the lack of public exploitation documented and its absence from the KEV catalogue suggests a moderate exploitation risk. Attackers must first authenticate as a viewer; after that, they can supply malicious parameters to the /executeDatasource endpoint and achieve data read or modify rights. The vulnerability requires no special privileges beyond standard viewer access, making it attractive to insiders or compromised accounts.