Skip to content
OpenAdvisories
High · 8.7 Public exploit CVE-2026-42096 EUVD-2026-30927GHSA-544c-gfhm-rwqf

Broken Access Control in Sparx Pro Cloud Server

Published May 19, 2026 · Updated May 19, 2026 · Assigned by CERT-PL

Vendor: Sparx Systems Product: Pro Cloud Server

Description

Sparx Pro Cloud Server is vulnerable to Broken Access Control within communication with the database. Due to lack of permission checks, any low privileged user can run arbitrary SQL queries within database user context.

The vendor was notified early about this vulnerability, but didn't respond with the details of vulnerability or vulnerable version range. Only version 6.1 (build 167) and below were tested and confirmed as vulnerable, other versions were not tested and might also be vulnerable.

Affected products

VendorProductAffectedFixed
Sparx Systems Pro Cloud Server ≤ 6.1 —

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 1 repository

  • br0xpl/sparx_hack ★ 0 · May 19, 2026

    Exploit code for CVE-2026-42096 and CVE-2026-42097 allowing for arbitrary SQL command execution without authentication.

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

References