An unauthenticated attacker can inject arbitrary SPARQL into the search API of djehuty through the 'order', 'operator', and 'key' parameters. The injection is limited to SELECT queries that read data, but it can reference graphs beyond the intended scope, allowing extraction of private, draft, or internal RDF data. Additionally, an attacker can craft computationally expensive or malformed queries that exhaust the SPARQL backend, causing denial of service. This weakness is classified as CWE‑943: Untrusted Search Path.

The affected product is the 4TUResearchData djehuty repository system. Versions prior to 26.3.2 are vulnerable; the issue was patched in the 26.3.2 release.

The CVSS score of 7.1 signals high impact potential. Because no authentication is required and the attack vector is a public HTTP endpoint, the vulnerability is readily exploitable. There is no listing in KEV and the EPSS score is unavailable, but the absence of an authentication barrier makes it a compelling target for attackers wishing to exfiltrate data or disrupt service. While the attacker cannot modify data, the ability to read cross‑graph data and to initiate a denial‑of‑service attack is a substantial risk.