SQLBot is an AI‑driven Text‑to‑SQL system that, before version 1.8.0, allowed an attacker to read and modify database schemas and data sources belonging to other tenants. The vulnerability is an Insecure Direct Object Reference (IDOR) that bypasses tenant isolation checks, enabling the modification of critical system objects. This flaw is identified as CWE‑639 and can lead to data tampering, privilege escalation within the application, and potential exposure of sensitive data across tenants.

The affected product is SQLBot by Dataease. All releases prior to 1.8.0 are vulnerable; the fix was applied in version 1.8.0. Tenants using earlier versions, regardless of deployment size or configuration, are susceptible.

The CVSS score of 8.6 indicates high severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting no known public exploits yet. The likely attack vector is via authenticated API calls to the /api/v1/datasource/exportDsSchema and /api/v1/datasource/uploadDsSchema endpoints, which an attacker with access to one tenant’s credentials could use to target other tenants. A successful exploit would grant the attacker full read/write access to other tenants’ database schemas.