An SQL Injection flaw resides in the EventRepository of BillaBear. User‑controlled metric filter names and aggregation property identifiers are embedded directly into SQL queries via sprintf without proper sanitization or identifier quoting. Although filter values are parameterized, the filter keys are not, allowing an attacker to inject arbitrary SQL statements. The vulnerability is exploitable by any authenticated user holding the ROLE_ACCOUNT_MANAGER permission, which can lead to unauthorized data retrieval, modification, or deletion within the database.

The issue affects all BillaBear deployments using versions released before January 2026. No other vendor or product versions are listed as impacted.

The CVSS score is 8.8, indicating high severity. The EPSS score is <1%, reflecting a low probability of exploitation, but a privileged attacker with the ROLE_ACCOUNT_MANAGER role can use the business‑logic API endpoints that accept metric filters to inject malicious SQL. The vulnerability is not listed in the CISA KEV catalog.