Tencent APIJSON version 8.1.8 contains a vulnerability that lets an unauthenticated user inject raw SQL fragments through the Map-form @having operator. The per-table access control is enforced only on the String form of @having, so the Map form bypasses the allow‑list, enabling arbitrary reading of database tables. This is a classic SQL injection that can expose sensitive data, leading to a high confidentiality breach.

The affected vendor is Tencent, product APIJSON, specifically the APIJSONORM library present in version 8.1.8. The flaw resides in the AbstractSQLConfig class, where the per-role allow‑list check is omitted for the Map-form @having payloads.

The CVSS score of 9.8 indicates a critical severity. While the EPSS score is not available, the vulnerability allows unauthenticated remote attackers to read any table configured with get:[] (empty), a privilege usually denied. The attack vector is inferred to be a crafted HTTP request targeting an API endpoint that processes Map-form @having parameters. The lack of a KEV listing does not diminish the potential impact, as similar unauthenticated SQL injections are frequently exploited. Given the critical score and the possibility of widespread read‑bypass, this vulnerability should be treated as highly exploitable.