An SQL Injection flaw resides in the EventRepository of BillaBear. User‑controlled metric filter names and aggregation property identifiers are embedded directly into SQL queries via sprintf without proper sanitization or identifier quoting. Although filter values are parameterized, the filter keys are not, allowing an attacker to inject arbitrary SQL statements. The vulnerability is exploitable by any authenticated user holding the ROLE_ACCOUNT_MANAGER permission, which can lead to unauthorized data retrieval, modification, or deletion within the database.

The issue affects all BillaBear deployments using versions released before January 2026. No other vendor or product versions are listed as impacted.

The CVSS score is not disclosed, but the lack of documented exploitation and the need for privileged access implies a moderate to high risk if attackers can acquire the ROLE_ACCOUNT_MANAGER role. No EPSS score is available and the vulnerability is not present in the CISA KEV catalog. Attackers would likely exploit the flaw through the business‑logic API endpoints that accept metric filters, leveraging the authenticated session to inject malicious SQL.