CVE-2026-31069 Details

A SQL injection vulnerability has been identified in BillaBear's EventRepository component, affecting all versions prior to January 2026. The vulnerability arises because user-controlled input from metric filter names and aggregation properties is directly inserted into SQL queries using sprintf(), without adequate sanitization or proper quoting of identifiers. While filter values are parameterized, the filter identifiers are not. This flaw allows an authenticated attacker with ROLE_ACCOUNT_MANAGER permissions to execute arbitrary SQL commands, potentially leading to a complete compromise of the application's database.

To address this vulnerability, BillaBear should implement proper validation and sanitization of metric filter names to prevent SQL injection. This can be achieved by whitelisting acceptable filter name formats or by using parameterized queries that bind filter names as identifiers rather than concatenating them directly into SQL strings.