Vulnerabilities ›

CVE-2025-15597

Medium ⚡ Exploit Available

A vulnerability has been found in Dataease SQLBot up to 1.4.0. This affects an unknown function of the file backend/apps/system/api/assistant.py of the component API Endpoint. Such manipulation leads

CWE-266 — Weakness Type

                    Published: Mar 2, 2026                      ·  Modified: Mar 5, 2026                      ·  Source: NVD                

CVSS v3

6.3

🔗 NVD Official

📄 Description (English)

A vulnerability has been found in Dataease SQLBot up to 1.4.0. This affects an unknown function of the file backend/apps/system/api/assistant.py of the component API Endpoint. Such manipulation leads to improper access controls. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.5.0 mitigates this issue. The name of the patch is d640ac31d1ce64ce90e06cf7081163915c9fc28c. Upgrading the affected component is recommended. Multiple endpoints are affected. The vendor was contacted early about this disclosure.

🤖 AI Executive Summary

CVE-2025-15597 is a medium-severity improper access control vulnerability in Dataease SQLBot versions up to 1.4.0 affecting the API endpoint in assistant.py. The vulnerability allows remote attackers to bypass access controls through manipulation of unknown functions, with public exploit code available. Immediate patching to version 1.5.0 is critical for organizations using this data analytics platform.

📄 Description (Arabic)

🤖 AI Intelligence Analysis Analyzed: May 16, 2026 17:30

🇸🇦 Saudi Arabia Impact Assessment

Saudi organizations using Dataease SQLBot for business intelligence and data analytics face unauthorized access risks to sensitive business data. Most impacted sectors include: Banking (SAMA-regulated institutions using SQLBot for financial analytics), Government agencies (NCA oversight entities using data analytics platforms), Healthcare (MOH facilities analyzing patient data), Energy sector (ARAMCO and downstream companies), and Telecommunications (STC and other operators). The improper access control could lead to unauthorized data exfiltration, compliance violations with SAMA regulations, and breach of NCA cybersecurity requirements.

🏢 Affected Saudi Sectors

Banking and Financial Services Government and Public Administration Healthcare Energy and Utilities Telecommunications Insurance Retail and E-commerce

🎯 MITRE ATT&CK Techniques

T1190 - Exploit Public-Facing Application T1566 - Phishing T1078 - Valid Accounts T1110 - Brute Force T1526 - Reconnaissance T1087 - Account Discovery T1580 - Cloud Infrastructure Discovery

⚖️ Saudi Risk Score (AI)

7.2

/ 10.0

🔧 Remediation Steps (English)

IMMEDIATE ACTIONS:

1. Identify all instances of Dataease SQLBot running versions 1.4.0 and earlier in your environment

2. Restrict network access to the affected API endpoint (backend/apps/system/api/assistant.py) using firewall rules

3. Implement IP whitelisting for legitimate API consumers only

4. Enable API authentication logging and monitoring



PATCHING:

5. Upgrade Dataease SQLBot to version 1.5.0 or later immediately (patch d640ac31d1ce64ce90e06cf7081163915c9fc28c)

6. Test the patch in a staging environment before production deployment

7. Verify all API endpoints are functioning correctly post-upgrade



COMPENSATING CONTROLS (if immediate patching not possible):

8. Deploy Web Application Firewall (WAF) rules to detect and block suspicious API requests to assistant.py

9. Implement API rate limiting and request validation

10. Conduct access control audits on all API endpoints



DETECTION:

11. Monitor logs for unauthorized API calls to /backend/apps/system/api/assistant.py

12. Alert on failed authentication attempts and access control violations

13. Track data exfiltration patterns from the analytics platform

🔧 خطوات المعالجة (العربية)

الإجراءات الفورية:

1. تحديد جميع حالات Dataease SQLBot التي تعمل بالإصدارات 1.4.0 والإصدارات الأقدم في بيئتك

2. تقييد الوصول إلى نقطة نهاية API المتأثرة (backend/apps/system/api/assistant.py) باستخدام قواعد جدار الحماية

3. تطبيق قائمة بيضاء للعناوين IP للمستهلكين الشرعيين فقط

4. تفعيل تسجيل ومراقبة مصادقة API

التصحيح:

5. ترقية Dataease SQLBot إلى الإصدار 1.5.0 أو أحدث على الفور (الرقعة d640ac31d1ce64ce90e06cf7081163915c9fc28c)

6. اختبار الرقعة في بيئة التدريج قبل نشر الإنتاج

7. التحقق من أن جميع نقاط نهاية API تعمل بشكل صحيح بعد الترقية

عناصر التحكم التعويضية (إذا لم يكن التصحيح الفوري ممكناً):

8. نشر قواعد جدار تطبيقات الويب (WAF) للكشف عن طلبات API المريبة وحجبها

9. تطبيق تحديد معدل API والتحقق من صحة الطلب

10. إجراء عمليات تدقيق التحكم في الوصول على جميع نقاط نهاية API

الكشف:

11. مراقبة السجلات لاستدعاءات API غير المصرح بها إلى /backend/apps/system/api/assistant.py

12. التنبيه على محاولات المصادقة الفاشلة وانتهاكات التحكم في الوصول

13. تتبع أنماط تسرب البيانات من منصة التحليلات

📋 Regulatory Compliance Mapping

🟢 NCA ECC 2024

ECC 2024 A.6.1.1 - Access Control Policy ECC 2024 A.6.2.1 - User Registration and De-registration ECC 2024 A.6.2.2 - User Access Rights ECC 2024 A.9.2.1 - User Access Management ECC 2024 A.9.4.3 - Segregation of Duties

🔵 SAMA CSF

SAMA CSF ID.AC-1 - Access Control Policy and Procedures SAMA CSF ID.AC-2 - Physical and Logical Access Controls SAMA CSF PR.AC-1 - Identities and Credentials Management SAMA CSF PR.AC-3 - Access Enforcement SAMA CSF DE.CM-1 - System Monitoring

🟡 ISO 27001:2022

ISO 27001:2022 A.5.3 - Segregation of Duties ISO 27001:2022 A.8.2 - User Access Management ISO 27001:2022 A.8.2.1 - User Registration and De-registration ISO 27001:2022 A.8.2.3 - Management of Privileged Access Rights ISO 27001:2022 A.8.3 - User Responsibilities

🟣 PCI DSS v4.0.1

PCI DSS 6.2 - Security Patches and Updates PCI DSS 7.1 - Limit Access to System Components PCI DSS 8.1 - Assign Unique ID to Each User

🔗 References & Sources 17

CVE-2025-15597

Introduce Yourself