The vendor was notified early about this vulnerability, but didn't respond with the details of vulnerability or vulnerable version range. Only version 6.1 (build 167) and below were tested and confirmed as vulnerable, other versions were not tested and might also be vulnerable.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| Sparx Systems | Pro Cloud Server | unknown |
|
No data.
No data.
No data.
Project Subscriptions
No data.
No advisories yet.
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
Tue, 19 May 2026 13:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Sparx Pro Cloud Server requires authentication based on requested URL. An attacker can omit the "model" query parameter and send the model name only in the binary blob in POST request allowing SQL query execution without authentication. The vendor was notified early about this vulnerability, but didn't respond with the details of vulnerability or vulnerable version range. Only version 6.1 (build 167) and below were tested and confirmed as vulnerable, other versions were not tested and might also be vulnerable. | |
| Title | Authentication Bypass in Sparx Pro Cloud Server | |
| Weaknesses | CWE-639 | |
| References |
| |
| Metrics |
cvssV4_0
|
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: CERT-PL
Published:
Updated: 2026-05-19T12:59:19.821Z
Reserved: 2026-04-24T12:15:00.858Z
Link: CVE-2026-42097
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-05-19T14:16:42.247
Modified: 2026-05-19T14:16:42.247
Link: CVE-2026-42097
Redhat
No data.
OpenCVE Enrichment
No data.