CVE-2026-42097

The application verifies user identity based on the 'model' parameter contained in the request URL. An attacker can omit this parameter in the URL and instead place the model name solely in the binary content (blob) of the POST request body. The authentication mechanism does not properly analyze this alternative path, as a result the SQL query reaches the database without prior verification of the requester's identity. This is a vulnerability classified as CWE-639 (Authorization Bypass Through User-Controlled Key) with a SQL injection component.

An unauthenticated remote attacker can execute arbitrary SQL queries in the server's database, which may lead to unauthorized reading and modification of stored data, including potentially sensitive architectural modeling data.

Patches available from the manufacturer should be applied according to references. Since the manufacturer did not respond to the vulnerability report, it is recommended to restrict network access to Sparx Pro Cloud Server instances (e.g., through firewall or VPN) and monitor HTTP traffic for suspicious POST requests until an official patch is released.

Sparx Pro Cloud Server version 6.1 (build 167) and lower — confirmed vulnerable. Other versions were not tested and may also be vulnerable. The manufacturer did not provide information about the scope of vulnerable versions.