Key points
- The flaw affects YS-infoware BA-Workflow versions prior to 3.6
- National Vulnerability Database rates the issue as high severity with a CVSS score of 8.7
- Authenticated remote attackers can read, modify, or delete data via SQL injection
YS-infoware BA-Workflow versions earlier than 3.6 contain a high-severity SQL injection vulnerability. The National Vulnerability Database assigns this flaw a CVSS score of 8.7. Authenticated remote attackers can exploit this weakness to inject arbitrary SQL statements. This capability allows them to read, modify, and delete database contents within the application.
In plain English
SQL injection occurs when an application fails to properly filter user input. Attackers can insert malicious code into database queries. In this specific case, the vulnerability exists in the BA-Workflow software. Once an attacker gains authenticated access, they can send crafted requests. These requests bypass normal application logic and directly interact with the underlying database. The result is unauthorized control over stored data.
The background
The National Vulnerability Database record identifies this issue as CVE-2026-113405. The weakness is classified under CWE-89, which covers SQL injection flaws. The affected product is developed by YS-infoware. The vulnerability is present in all releases of BA-Workflow before version 3.6. The description specifies that the attacker must be authenticated to trigger the exploit. This means they need valid login credentials to perform the attack.
What changes now
Organizations using BA-Workflow must verify their current version immediately. If the installed version is older than 3.6, it is vulnerable. The source material indicates that version 3.6 addresses this issue. Users should upgrade to this version or newer to remove the risk. No other mitigation or patch is mentioned in the available records. Upgrading is the only confirmed way to resolve the vulnerability.
Who needs to act first
Teams should prioritize updating systems that are accessible from external networks or contain sensitive data. Before rolling out the update, administrators must test the new version in a non-production environment to ensure compatibility. Backing up existing databases and configurations is essential before making any changes. If immediate updating is not possible, restrict access to the application and monitor logs for unusual activity. This approach minimizes the window of exposure while preparing for the fix.
What to do and how to stay safe: YS-infoware
- Check your current BA-Workflow version and compare it against the vulnerable range
- Plan an upgrade to version 3.6 or later as soon as possible
- Audit user accounts to ensure only necessary personnel have authenticated access
- Monitor database logs for unexpected queries or data changes after any access
Step-by-step guide: Emergency Patching: How to Fix Critical Flaws Without Breaking Systems
General security guidance from the Patch Review newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS score for this vulnerability?
The National Vulnerability Database rates CVE-2026-113405 as high severity with a CVSS score of 8.7.
Which versions of BA-Workflow are affected?
All versions of YS-infoware BA-Workflow prior to version 3.6 are affected by this SQL injection flaw.
Does an attacker need to be logged in to exploit this?
Yes, the source material states that authenticated remote attackers can inject arbitrary SQL statements.
