CVE-2026-4289
Published: 17 March 2026
Summary
CVE-2026-4289 is a medium-severity Injection (CWE-74) vulnerability in Feishu (inferred from references). Its CVSS base score is 6.9 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 13.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2026-4289 is a SQL injection vulnerability in the Tiandy Easy7 Integrated Management Platform versions up to 7.17.0. The flaw resides in an unknown function within the /rest/preSetTemplate/getRecByTemplateId endpoint, where manipulation of the ID argument triggers the injection. It is classified under CWE-74 (Improper Neutralization of Special Elements used in an SQL Command) and CWE-89 (SQL Injection), with a CVSS v3.1 base score of 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L), indicating high severity due to its network accessibility and lack of prerequisites.
The vulnerability can be exploited remotely by unauthenticated attackers with no privileges or user interaction required. Successful exploitation allows limited impacts on confidentiality, integrity, and availability, potentially enabling data exfiltration, modification of database contents, or denial-of-service conditions through crafted SQL payloads targeting the ID parameter.
Advisories from VulDB and related disclosures note that the exploit has been publicly released and is available for use, with the vendor contacted early but providing no response or patch. Practitioners should review the referenced URLs, including https://vuldb.com/?ctiid.351294, https://vuldb.com/?id.351294, and https://vuldb.com/?submit.771997, for PoC details and monitor for updates, as no official mitigation from Tiandy is available.
The vulnerability was published on 2026-03-17, and its public exploit disclosure heightens the risk of active exploitation in exposed Tiandy Easy7 deployments.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-12531
Vulnerability details
A security vulnerability has been detected in Tiandy Easy7 Integrated Management Platform up to 7.17.0. This affects an unknown function of the file /rest/preSetTemplate/getRecByTemplateId. The manipulation of the argument ID leads to sql injection. The attack may be initiated remotely.…
more
The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
SQL injection in unauthenticated public REST endpoint directly enables remote exploitation of web app (T1190); crafted payloads allow unauthorized database queries for data exfiltration (T1213.006).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SI-10 directly prevents SQL injection by requiring validation and neutralization of special elements in the ID parameter at the vulnerable endpoint.
SI-2 ensures timely identification, reporting, and remediation of the SQL injection flaw, including patching despite vendor inaction.
RA-5 mandates vulnerability scanning that would detect the SQL injection in the /rest/preSetTemplate/getRecByTemplateId endpoint and trigger remediation.