A SQL injection flaw exists in the get_last_seen RPC of Posit Workbench’s code‑server session‑state feature. Based on the description, it is inferred that an authenticated user can supply a crafted sessionIds parameter that is concatenated directly into an SQL query, enabling the execution of arbitrary SELECT statements against the Workbench database. The impact is the disclosure of sensitive data; there is no documented vector for code execution, privilege escalation, or denial of service.

The vulnerability affects all installations of Posit Software’s PBC Posit Workbench prior to version 2026.08.0. The affected product is Posit Workbench. Users of any earlier build are potentially vulnerable until they upgrade to 2026.08.0 or a later patched release.

The CVSS score of 5.7 indicates a medium severity, largely due to the requirement of an existing authenticated session. EPSS information is not available, and the vulnerability is not listed in the CISA KEV catalog. It applies to authenticated users without administrative privileges. Based on the description, it is inferred that the attacker can extract arbitrary database contents via a crafted sessionIds parameter. The flaw is limited to read‑only data disclosure, so it does not threaten system integrity or availability, but the risk to confidentiality is significant.