Tencent APIJSON 8.1.8 contains a SQL injection flaw that permits unauthenticated attackers to bypass per‑table access control and read any database table. The vulnerability exploits the Map form @having operator, which bypasses the per‑role allow-list that normally protects against injection. As a result, an attacker can retrieve arbitrary data from tables configured with get:[] and expose sensitive information. This flaw leads to a severe confidentiality breach.

The affected vendor is Tencent, product APIJSON, specifically the APIJSONORM library present in version 8.1.8. The flaw resides in the AbstractSQLConfig class, where the per-role allow-list check is omitted for the Map form @having payloads.

The CVSS score of 9.8 indicates a critical severity. While the EPSS score is not available, the vulnerability allows unauthenticated remote attackers to read any table configured with get:[] (empty), a privilege usually denied. The attack vector is inferred to be a crafted HTTP request targeting an API endpoint that processes Map-form @having parameters. The lack of a KEV listing does not diminish the potential impact, as similar unauthenticated SQL injections are frequently exploited. Given the critical score and the possibility of widespread read‑bypass, this vulnerability should be treated as highly exploitable.