CVE-2025-15597: Dataease SQLBot API Endpoint assistant.py access control

Vulnerability summary

CVE-2025-15597 is a medium (CVSS 6.5) Incorrect Privilege Assignment vulnerability in dataease sqlbot. EPSS estimates a 0.61% chance of exploitation in the next 30 days, higher than 49% of scored vulnerabilities. 2 public exploits are recorded.

Timeline

1. 02-03-2026
   PublishedVulnerability first disclosed.
2. 02-03-2026
   Last modifiedVulnerability information updated.

Description

A vulnerability has been found in Dataease SQLBot up to 1.4.0. This affects an unknown function of the file backend/apps/system/api/assistant.py of the component API Endpoint. Such manipulation leads to improper access controls. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.5.0 mitigates this issue. The name of the patch is d640ac31d1ce64ce90e06cf7081163915c9fc28c. Upgrading the affected component is recommended. Multiple endpoints are affected. The vendor was contacted early about this disclosure.

• CWE-266Incorrect Privilege AssignmentA product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor.
• CWE-284Improper Access ControlThe product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.