Vulnerability-Lookup

Search criteria

Vendor

Product

Assigner (CNA or root)

Sources

Sort by

Order

CVSS min

CVSS max

Apply ordering (override relevance)

CVE-2026-63664 (GCVE-0-2026-63664)

Vulnerability from nvd – Published: 2026-11-06 20:06 – Updated: 2026-11-09 22:43

Title

CloudBeaver: Authorization Bypass (BFLA) - Data Export Restriction Bypass

Summary

CloudBeaver is a cloud database manager. In versions up to and including 26.1.1, some server-side export operations do not consistently enforce the global data export restriction. An authenticated non-administrative user with access to a shared database connection can initiate certain server-side data exports even when an administrator has disabled exports. This can disclose database contents that the user is permitted to query but is not permitted to export. The issue does not grant additional database read privileges. It is fixed in 26.1.2 by consistently enforcing the global restriction for server-side exports.

Severity

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-11-09 22:35 UTC

CWE

CWE-862 - Missing Authorization

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7787 records in the last 180 days details

References

3 references

URL	Tags
https://github.com/dbeaver/cloudbeaver/security/a…	x_refsource_CONFIRM
https://github.com/dbeaver/cloudbeaver/pull/4394	x_refsource_MISC
https://github.com/dbeaver/cloudbeaver/commit/58f…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
dbeaver	cloudbeaver	Affected: < 26.1.2

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-63664",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-09T22:35:06.133774Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-09T22:43:35.857Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "cloudbeaver",
          "vendor": "dbeaver",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 26.1.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "CloudBeaver is a cloud database manager. In versions up to and including 26.1.1, some server-side export operations do not consistently enforce the global data export restriction. An authenticated non-administrative user with access to a shared database connection can initiate certain server-side data exports even when an administrator has disabled exports. This can disclose database contents that the user is permitted to query but is not permitted to export. The issue does not grant additional database read privileges. It is fixed in 26.1.2 by consistently enforcing the global restriction for server-side exports."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862: Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-06T20:06:09.316Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/dbeaver/cloudbeaver/security/advisories/GHSA-9vv7-rf3x-8xr8",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/dbeaver/cloudbeaver/security/advisories/GHSA-9vv7-rf3x-8xr8"
        },
        {
          "name": "https://github.com/dbeaver/cloudbeaver/pull/4394",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/dbeaver/cloudbeaver/pull/4394"
        },
        {
          "name": "https://github.com/dbeaver/cloudbeaver/commit/58f51ee5f6fc1e93b14f4d96c1f75fbcc13407e9",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/dbeaver/cloudbeaver/commit/58f51ee5f6fc1e93b14f4d96c1f75fbcc13407e9"
        }
      ],
      "source": {
        "advisory": "GHSA-9vv7-rf3x-8xr8",
        "discovery": "UNKNOWN"
      },
      "title": "CloudBeaver: Authorization Bypass (BFLA) - Data Export Restriction Bypass"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-63664",
    "datePublished": "2026-11-06T20:06:09.316Z",
    "dateReserved": "2026-07-17T14:47:08.031Z",
    "dateUpdated": "2026-11-09T22:43:35.857Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-63663 (GCVE-0-2026-63663)

Vulnerability from nvd – Published: 2026-11-06 20:07 – Updated: 2026-11-06 20:07

Title

CloudBeaver: Path Traversal in updateResultsDataBatch Allows Unauthorized Server File Stream Access

Summary

CloudBeaver is a cloud database manager. From version 23.2.3 until 26.1.2, a path traversal vulnerability in its SQL result-editing functionality allows an authenticated user with SQL result-editing privileges to cause the server to open files outside the intended temporary upload directory. In affected database value-handling scenarios, this can disclose local files readable by the CloudBeaver server process. Version 26.1.2 prevents traversal outside the intended temporary upload directory.

Severity

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

CWE

CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7787 records in the last 180 days details

References

3 references

URL	Tags
https://github.com/dbeaver/cloudbeaver/security/a…	x_refsource_CONFIRM
https://github.com/dbeaver/cloudbeaver/pull/4411	x_refsource_MISC
https://github.com/dbeaver/cloudbeaver/commit/cae…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
dbeaver	cloudbeaver	Affected: >= 23.2.3, < 26.1.2

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "cloudbeaver",
          "vendor": "dbeaver",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 23.2.3, \u003c 26.1.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "CloudBeaver is a cloud database manager. From version 23.2.3 until 26.1.2, a path traversal vulnerability in its SQL result-editing functionality allows an authenticated user with SQL result-editing privileges to cause the server to open files outside the intended temporary upload directory. In affected database value-handling scenarios, this can disclose local files readable by the CloudBeaver server process. Version 26.1.2 prevents traversal outside the intended temporary upload directory."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-06T20:07:41.007Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/dbeaver/cloudbeaver/security/advisories/GHSA-8wr4-mh28-m992",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/dbeaver/cloudbeaver/security/advisories/GHSA-8wr4-mh28-m992"
        },
        {
          "name": "https://github.com/dbeaver/cloudbeaver/pull/4411",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/dbeaver/cloudbeaver/pull/4411"
        },
        {
          "name": "https://github.com/dbeaver/cloudbeaver/commit/caef729a8d227b0446eab6f0ae5f1dc20dced9b5",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/dbeaver/cloudbeaver/commit/caef729a8d227b0446eab6f0ae5f1dc20dced9b5"
        }
      ],
      "source": {
        "advisory": "GHSA-8wr4-mh28-m992",
        "discovery": "UNKNOWN"
      },
      "title": "CloudBeaver: Path Traversal in updateResultsDataBatch Allows Unauthorized Server File Stream Access"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-63663",
    "datePublished": "2026-11-06T20:07:41.007Z",
    "dateReserved": "2026-07-17T14:47:08.031Z",
    "dateUpdated": "2026-11-06T20:07:41.007Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-55449 (GCVE-0-2026-55449)

Vulnerability from nvd – Published: 2026-11-06 20:04 – Updated: 2026-11-10 20:06

Title

CloudBeaver: Path Traversal in Resource Manager getProjectPath allows directory enumeration outside shared-projects sandbox

Summary

CloudBeaver is a cloud database manager. Prior to 26.1.2, its resource-management project resolution accepts project identifiers without validating that they are safe path components. An authenticated user with resource-management privileges can supply a crafted project identifier that causes path resolution to escape the shared-projects directory and enumerate directory names elsewhere on the server. This can disclose filesystem layout information. Arbitrary file reads, writes, and deletion are not confirmed. The issue is fixed in 26.1.2 by validating project names before resolving the shared-project path.

Severity

5.3 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-11-10 20:06 UTC

CWE

CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7787 records in the last 180 days details

References

3 references

URL	Tags
https://github.com/dbeaver/cloudbeaver/security/a…	x_refsource_CONFIRM
https://github.com/dbeaver/cloudbeaver/pull/4367	x_refsource_MISC
https://github.com/dbeaver/cloudbeaver/commit/a33…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
dbeaver	cloudbeaver	Affected: < 26.1.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-55449",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-10T20:06:45.532921Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-10T20:06:53.574Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "cloudbeaver",
          "vendor": "dbeaver",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 26.1.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "CloudBeaver is a cloud database manager. Prior to 26.1.2, its resource-management project resolution accepts project identifiers without validating that they are safe path components. An authenticated user with resource-management privileges can supply a crafted project identifier that causes path resolution to escape the shared-projects directory and enumerate directory names elsewhere on the server. This can disclose filesystem layout information. Arbitrary file reads, writes, and deletion are not confirmed. The issue is fixed in 26.1.2 by validating project names before resolving the shared-project path."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "NONE"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-06T20:04:56.279Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/dbeaver/cloudbeaver/security/advisories/GHSA-6x6p-mrpr-wfq9",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/dbeaver/cloudbeaver/security/advisories/GHSA-6x6p-mrpr-wfq9"
        },
        {
          "name": "https://github.com/dbeaver/cloudbeaver/pull/4367",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/dbeaver/cloudbeaver/pull/4367"
        },
        {
          "name": "https://github.com/dbeaver/cloudbeaver/commit/a333e5841a18b38c82d3769a55974700108cedbe",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/dbeaver/cloudbeaver/commit/a333e5841a18b38c82d3769a55974700108cedbe"
        }
      ],
      "source": {
        "advisory": "GHSA-6x6p-mrpr-wfq9",
        "discovery": "UNKNOWN"
      },
      "title": "CloudBeaver: Path Traversal in Resource Manager getProjectPath allows directory enumeration outside shared-projects sandbox"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-55449",
    "datePublished": "2026-11-06T20:04:56.279Z",
    "dateReserved": "2026-06-16T21:59:57.018Z",
    "dateUpdated": "2026-11-10T20:06:53.574Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-108745 (GCVE-0-2026-108745)

Vulnerability from nvd – Published: 2026-10-11 12:19 – Updated: 2026-10-14 13:29

Title

CloudBeaver through 25.3.5 Missing Authorization via /api/sql-result-value Servlet

Summary

CloudBeaver through 25.3.5 contains a missing authorization vulnerability in WebSQLResultServlet that allows any web session holder to read other users' LOB export files from a shared folder. Attackers can guess table and column names and enumerate second-resolution timestamps to download victims' LOB values, including data from connections they cannot query.

Severity

2.3 (Low)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

3.1 (Low)


                        
                          CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-14 13:29 UTC

CWE

CWE-862 - Missing Authorization

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 7785 records in the last 180 days details

References

5 references

URL	Tags
https://hackmd.io/@haind03/cloudbeaver-sql-lob-se…	third-party-advisory
https://github.com/dbeaver/cloudbeaver/blob/48885…	technical-description
https://github.com/dbeaver/cloudbeaver/blob/48885…	technical-description
https://github.com/dbeaver/cloudbeaver	product
https://www.vulncheck.com/advisories/cloudbeaver-…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
DBeaver	CloudBeaver	Affected: 0 , ≤ 25.3.5 (semver)

Date Public

2026-10-10 00:00

Credits

HaiND from the Post and Telecommunication Institute of Technology

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-108745",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-14T13:29:22.390443Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-14T13:29:34.913Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:github/dbeaver/cloudbeaver",
          "product": "CloudBeaver",
          "repo": "https://github.com/dbeaver/cloudbeaver",
          "vendor": "DBeaver",
          "versions": [
            {
              "lessThanOrEqual": "25.3.5",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "HaiND from the Post and Telecommunication Institute of Technology"
        }
      ],
      "datePublic": "2026-10-10T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "CloudBeaver through 25.3.5 contains a missing authorization vulnerability in WebSQLResultServlet that allows any web session holder to read other users\u0027 LOB export files from a shared folder. Attackers can guess table and column names and enumerate second-resolution timestamps to download victims\u0027 LOB values, including data from connections they cannot query."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 2.3,
            "baseSeverity": "LOW",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.1,
            "baseSeverity": "LOW",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-11T12:19:47.387Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://hackmd.io/@haind03/cloudbeaver-sql-lob-servlet-missing-authorization"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/dbeaver/cloudbeaver/blob/48885c48f5fbd363bf3391f47a669629b4f3dd24/server/bundles/io.cloudbeaver.server/src/io/cloudbeaver/service/sql/WebSQLResultServlet.java#L57-L94"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/dbeaver/cloudbeaver/blob/48885c48f5fbd363bf3391f47a669629b4f3dd24/server/bundles/io.cloudbeaver.server/src/io/cloudbeaver/service/sql/WebSQLDataLOBReceiver.java#L37-L70"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/dbeaver/cloudbeaver"
        },
        {
          "name": "VulnCheck Advisory: CloudBeaver through 25.3.5 Missing Authorization via /api/sql-result-value Servlet",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/cloudbeaver-through-25.3.5-missing-authorization-via-api-sql-result-value-servlet"
        }
      ],
      "title": "CloudBeaver through 25.3.5 Missing Authorization via /api/sql-result-value Servlet",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-108745",
    "datePublished": "2026-10-11T12:19:47.387Z",
    "dateReserved": "2026-10-11T01:53:20.486Z",
    "dateUpdated": "2026-10-14T13:29:34.913Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-108742 (GCVE-0-2026-108742)

Vulnerability from nvd – Published: 2026-10-11 12:19 – Updated: 2026-10-13 19:46

Title

CloudBeaver through 25.3.5 Missing Authorization via initConnection GraphQL Mutation

Summary

CloudBeaver through 25.3.5 contains a missing authorization vulnerability in the initConnection GraphQL mutation that lets view-only shared-project members persist credentials without datasource-edit permission. Attackers can set saveCredentials and sharedCredentials flags with chosen authProperties so other users connect to the shared connection under the attacker's database identity.

Severity

5.3 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

4.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-13 19:45 UTC

CWE

CWE-862 - Missing Authorization

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 7785 records in the last 180 days details

References

6 references

URL	Tags
https://hackmd.io/@haind03/cloudbeaver-initconnec…	third-party-advisory
https://github.com/dbeaver/cloudbeaver/blob/48885…	technical-description
https://github.com/dbeaver/cloudbeaver/blob/48885…	technical-description
https://github.com/dbeaver/cloudbeaver	product
https://www.vulncheck.com/advisories/cloudbeaver-…	third-party-advisory
https://hackmd.io/@haind03/cve-2026-108742-cloudb…	exploit

Impacted products

1 product

Vendor	Product	Version
DBeaver	CloudBeaver	Affected: 0 , ≤ 25.3.5 (semver)

Date Public

2026-10-10 00:00

Credits

HaiND from the Post and Telecommunication Institute of Technology

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-108742",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-13T19:45:59.359764Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-13T19:46:24.849Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://hackmd.io/@haind03/cve-2026-108742-cloudbeaver-initconnection-shared-credential-authz-bypass"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:github/dbeaver/cloudbeaver",
          "product": "CloudBeaver",
          "repo": "https://github.com/dbeaver/cloudbeaver",
          "vendor": "DBeaver",
          "versions": [
            {
              "lessThanOrEqual": "25.3.5",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "HaiND from the Post and Telecommunication Institute of Technology"
        }
      ],
      "datePublic": "2026-10-10T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "CloudBeaver through 25.3.5 contains a missing authorization vulnerability in the initConnection GraphQL mutation that lets view-only shared-project members persist credentials without datasource-edit permission. Attackers can set saveCredentials and sharedCredentials flags with chosen authProperties so other users connect to the shared connection under the attacker\u0027s database identity."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-11T12:19:46.154Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://hackmd.io/@haind03/cloudbeaver-initconnection-shared-credential-authz-bypass"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/dbeaver/cloudbeaver/blob/48885c48f5fbd363bf3391f47a669629b4f3dd24/server/bundles/io.cloudbeaver.server/src/io/cloudbeaver/service/core/DBWServiceCore.java#L130-L140"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/dbeaver/cloudbeaver/blob/48885c48f5fbd363bf3391f47a669629b4f3dd24/server/bundles/io.cloudbeaver.server/src/io/cloudbeaver/service/core/impl/WebServiceCore.java#L349-L480"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/dbeaver/cloudbeaver"
        },
        {
          "name": "VulnCheck Advisory: CloudBeaver through 25.3.5 Missing Authorization via initConnection GraphQL Mutation",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/cloudbeaver-through-25.3.5-missing-authorization-via-initconnection-graphql-mutation"
        }
      ],
      "title": "CloudBeaver through 25.3.5 Missing Authorization via initConnection GraphQL Mutation",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-108742",
    "datePublished": "2026-10-11T12:19:46.154Z",
    "dateReserved": "2026-10-11T01:53:16.533Z",
    "dateUpdated": "2026-10-13T19:46:24.849Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-63663 (GCVE-0-2026-63663)

Vulnerability from cvelistv5 – Published: 2026-11-06 20:07 – Updated: 2026-11-06 20:07

Title

CloudBeaver: Path Traversal in updateResultsDataBatch Allows Unauthorized Server File Stream Access

Summary

CloudBeaver is a cloud database manager. From version 23.2.3 until 26.1.2, a path traversal vulnerability in its SQL result-editing functionality allows an authenticated user with SQL result-editing privileges to cause the server to open files outside the intended temporary upload directory. In affected database value-handling scenarios, this can disclose local files readable by the CloudBeaver server process. Version 26.1.2 prevents traversal outside the intended temporary upload directory.

Severity

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

CWE

CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7787 records in the last 180 days details

References

3 references

URL	Tags
https://github.com/dbeaver/cloudbeaver/security/a…	x_refsource_CONFIRM
https://github.com/dbeaver/cloudbeaver/pull/4411	x_refsource_MISC
https://github.com/dbeaver/cloudbeaver/commit/cae…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
dbeaver	cloudbeaver	Affected: >= 23.2.3, < 26.1.2

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "cloudbeaver",
          "vendor": "dbeaver",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 23.2.3, \u003c 26.1.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "CloudBeaver is a cloud database manager. From version 23.2.3 until 26.1.2, a path traversal vulnerability in its SQL result-editing functionality allows an authenticated user with SQL result-editing privileges to cause the server to open files outside the intended temporary upload directory. In affected database value-handling scenarios, this can disclose local files readable by the CloudBeaver server process. Version 26.1.2 prevents traversal outside the intended temporary upload directory."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-06T20:07:41.007Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/dbeaver/cloudbeaver/security/advisories/GHSA-8wr4-mh28-m992",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/dbeaver/cloudbeaver/security/advisories/GHSA-8wr4-mh28-m992"
        },
        {
          "name": "https://github.com/dbeaver/cloudbeaver/pull/4411",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/dbeaver/cloudbeaver/pull/4411"
        },
        {
          "name": "https://github.com/dbeaver/cloudbeaver/commit/caef729a8d227b0446eab6f0ae5f1dc20dced9b5",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/dbeaver/cloudbeaver/commit/caef729a8d227b0446eab6f0ae5f1dc20dced9b5"
        }
      ],
      "source": {
        "advisory": "GHSA-8wr4-mh28-m992",
        "discovery": "UNKNOWN"
      },
      "title": "CloudBeaver: Path Traversal in updateResultsDataBatch Allows Unauthorized Server File Stream Access"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-63663",
    "datePublished": "2026-11-06T20:07:41.007Z",
    "dateReserved": "2026-07-17T14:47:08.031Z",
    "dateUpdated": "2026-11-06T20:07:41.007Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-63664 (GCVE-0-2026-63664)

Vulnerability from cvelistv5 – Published: 2026-11-06 20:06 – Updated: 2026-11-09 22:43

Title

CloudBeaver: Authorization Bypass (BFLA) - Data Export Restriction Bypass

Summary

CloudBeaver is a cloud database manager. In versions up to and including 26.1.1, some server-side export operations do not consistently enforce the global data export restriction. An authenticated non-administrative user with access to a shared database connection can initiate certain server-side data exports even when an administrator has disabled exports. This can disclose database contents that the user is permitted to query but is not permitted to export. The issue does not grant additional database read privileges. It is fixed in 26.1.2 by consistently enforcing the global restriction for server-side exports.

Severity

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-11-09 22:35 UTC

CWE

CWE-862 - Missing Authorization

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7787 records in the last 180 days details

References

3 references

URL	Tags
https://github.com/dbeaver/cloudbeaver/security/a…	x_refsource_CONFIRM
https://github.com/dbeaver/cloudbeaver/pull/4394	x_refsource_MISC
https://github.com/dbeaver/cloudbeaver/commit/58f…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
dbeaver	cloudbeaver	Affected: < 26.1.2

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-63664",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-09T22:35:06.133774Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-09T22:43:35.857Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "cloudbeaver",
          "vendor": "dbeaver",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 26.1.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "CloudBeaver is a cloud database manager. In versions up to and including 26.1.1, some server-side export operations do not consistently enforce the global data export restriction. An authenticated non-administrative user with access to a shared database connection can initiate certain server-side data exports even when an administrator has disabled exports. This can disclose database contents that the user is permitted to query but is not permitted to export. The issue does not grant additional database read privileges. It is fixed in 26.1.2 by consistently enforcing the global restriction for server-side exports."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862: Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-06T20:06:09.316Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/dbeaver/cloudbeaver/security/advisories/GHSA-9vv7-rf3x-8xr8",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/dbeaver/cloudbeaver/security/advisories/GHSA-9vv7-rf3x-8xr8"
        },
        {
          "name": "https://github.com/dbeaver/cloudbeaver/pull/4394",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/dbeaver/cloudbeaver/pull/4394"
        },
        {
          "name": "https://github.com/dbeaver/cloudbeaver/commit/58f51ee5f6fc1e93b14f4d96c1f75fbcc13407e9",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/dbeaver/cloudbeaver/commit/58f51ee5f6fc1e93b14f4d96c1f75fbcc13407e9"
        }
      ],
      "source": {
        "advisory": "GHSA-9vv7-rf3x-8xr8",
        "discovery": "UNKNOWN"
      },
      "title": "CloudBeaver: Authorization Bypass (BFLA) - Data Export Restriction Bypass"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-63664",
    "datePublished": "2026-11-06T20:06:09.316Z",
    "dateReserved": "2026-07-17T14:47:08.031Z",
    "dateUpdated": "2026-11-09T22:43:35.857Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-55449 (GCVE-0-2026-55449)

Vulnerability from cvelistv5 – Published: 2026-11-06 20:04 – Updated: 2026-11-10 20:06

Title

CloudBeaver: Path Traversal in Resource Manager getProjectPath allows directory enumeration outside shared-projects sandbox

Summary

CloudBeaver is a cloud database manager. Prior to 26.1.2, its resource-management project resolution accepts project identifiers without validating that they are safe path components. An authenticated user with resource-management privileges can supply a crafted project identifier that causes path resolution to escape the shared-projects directory and enumerate directory names elsewhere on the server. This can disclose filesystem layout information. Arbitrary file reads, writes, and deletion are not confirmed. The issue is fixed in 26.1.2 by validating project names before resolving the shared-project path.

Severity

5.3 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-11-10 20:06 UTC

CWE

CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7787 records in the last 180 days details

References

3 references

URL	Tags
https://github.com/dbeaver/cloudbeaver/security/a…	x_refsource_CONFIRM
https://github.com/dbeaver/cloudbeaver/pull/4367	x_refsource_MISC
https://github.com/dbeaver/cloudbeaver/commit/a33…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
dbeaver	cloudbeaver	Affected: < 26.1.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-55449",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-10T20:06:45.532921Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-10T20:06:53.574Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "cloudbeaver",
          "vendor": "dbeaver",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 26.1.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "CloudBeaver is a cloud database manager. Prior to 26.1.2, its resource-management project resolution accepts project identifiers without validating that they are safe path components. An authenticated user with resource-management privileges can supply a crafted project identifier that causes path resolution to escape the shared-projects directory and enumerate directory names elsewhere on the server. This can disclose filesystem layout information. Arbitrary file reads, writes, and deletion are not confirmed. The issue is fixed in 26.1.2 by validating project names before resolving the shared-project path."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "NONE"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-06T20:04:56.279Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/dbeaver/cloudbeaver/security/advisories/GHSA-6x6p-mrpr-wfq9",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/dbeaver/cloudbeaver/security/advisories/GHSA-6x6p-mrpr-wfq9"
        },
        {
          "name": "https://github.com/dbeaver/cloudbeaver/pull/4367",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/dbeaver/cloudbeaver/pull/4367"
        },
        {
          "name": "https://github.com/dbeaver/cloudbeaver/commit/a333e5841a18b38c82d3769a55974700108cedbe",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/dbeaver/cloudbeaver/commit/a333e5841a18b38c82d3769a55974700108cedbe"
        }
      ],
      "source": {
        "advisory": "GHSA-6x6p-mrpr-wfq9",
        "discovery": "UNKNOWN"
      },
      "title": "CloudBeaver: Path Traversal in Resource Manager getProjectPath allows directory enumeration outside shared-projects sandbox"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-55449",
    "datePublished": "2026-11-06T20:04:56.279Z",
    "dateReserved": "2026-06-16T21:59:57.018Z",
    "dateUpdated": "2026-11-10T20:06:53.574Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-108745 (GCVE-0-2026-108745)

Vulnerability from cvelistv5 – Published: 2026-10-11 12:19 – Updated: 2026-10-14 13:29

Title

CloudBeaver through 25.3.5 Missing Authorization via /api/sql-result-value Servlet

Summary

CloudBeaver through 25.3.5 contains a missing authorization vulnerability in WebSQLResultServlet that allows any web session holder to read other users' LOB export files from a shared folder. Attackers can guess table and column names and enumerate second-resolution timestamps to download victims' LOB values, including data from connections they cannot query.

Severity

2.3 (Low)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

3.1 (Low)


                        
                          CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-14 13:29 UTC

CWE

CWE-862 - Missing Authorization

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 7785 records in the last 180 days details

References

5 references

URL	Tags
https://hackmd.io/@haind03/cloudbeaver-sql-lob-se…	third-party-advisory
https://github.com/dbeaver/cloudbeaver/blob/48885…	technical-description
https://github.com/dbeaver/cloudbeaver/blob/48885…	technical-description
https://github.com/dbeaver/cloudbeaver	product
https://www.vulncheck.com/advisories/cloudbeaver-…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
DBeaver	CloudBeaver	Affected: 0 , ≤ 25.3.5 (semver)

Date Public

2026-10-10 00:00

Credits

HaiND from the Post and Telecommunication Institute of Technology

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-108745",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-14T13:29:22.390443Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-14T13:29:34.913Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:github/dbeaver/cloudbeaver",
          "product": "CloudBeaver",
          "repo": "https://github.com/dbeaver/cloudbeaver",
          "vendor": "DBeaver",
          "versions": [
            {
              "lessThanOrEqual": "25.3.5",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "HaiND from the Post and Telecommunication Institute of Technology"
        }
      ],
      "datePublic": "2026-10-10T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "CloudBeaver through 25.3.5 contains a missing authorization vulnerability in WebSQLResultServlet that allows any web session holder to read other users\u0027 LOB export files from a shared folder. Attackers can guess table and column names and enumerate second-resolution timestamps to download victims\u0027 LOB values, including data from connections they cannot query."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 2.3,
            "baseSeverity": "LOW",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.1,
            "baseSeverity": "LOW",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-11T12:19:47.387Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://hackmd.io/@haind03/cloudbeaver-sql-lob-servlet-missing-authorization"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/dbeaver/cloudbeaver/blob/48885c48f5fbd363bf3391f47a669629b4f3dd24/server/bundles/io.cloudbeaver.server/src/io/cloudbeaver/service/sql/WebSQLResultServlet.java#L57-L94"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/dbeaver/cloudbeaver/blob/48885c48f5fbd363bf3391f47a669629b4f3dd24/server/bundles/io.cloudbeaver.server/src/io/cloudbeaver/service/sql/WebSQLDataLOBReceiver.java#L37-L70"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/dbeaver/cloudbeaver"
        },
        {
          "name": "VulnCheck Advisory: CloudBeaver through 25.3.5 Missing Authorization via /api/sql-result-value Servlet",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/cloudbeaver-through-25.3.5-missing-authorization-via-api-sql-result-value-servlet"
        }
      ],
      "title": "CloudBeaver through 25.3.5 Missing Authorization via /api/sql-result-value Servlet",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-108745",
    "datePublished": "2026-10-11T12:19:47.387Z",
    "dateReserved": "2026-10-11T01:53:20.486Z",
    "dateUpdated": "2026-10-14T13:29:34.913Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-108742 (GCVE-0-2026-108742)

Vulnerability from cvelistv5 – Published: 2026-10-11 12:19 – Updated: 2026-10-13 19:46

Title

CloudBeaver through 25.3.5 Missing Authorization via initConnection GraphQL Mutation

Summary

CloudBeaver through 25.3.5 contains a missing authorization vulnerability in the initConnection GraphQL mutation that lets view-only shared-project members persist credentials without datasource-edit permission. Attackers can set saveCredentials and sharedCredentials flags with chosen authProperties so other users connect to the shared connection under the attacker's database identity.

Severity

5.3 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

4.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-13 19:45 UTC

CWE

CWE-862 - Missing Authorization

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 7785 records in the last 180 days details

References

6 references

URL	Tags
https://hackmd.io/@haind03/cloudbeaver-initconnec…	third-party-advisory
https://github.com/dbeaver/cloudbeaver/blob/48885…	technical-description
https://github.com/dbeaver/cloudbeaver/blob/48885…	technical-description
https://github.com/dbeaver/cloudbeaver	product
https://www.vulncheck.com/advisories/cloudbeaver-…	third-party-advisory
https://hackmd.io/@haind03/cve-2026-108742-cloudb…	exploit

Impacted products

1 product

Vendor	Product	Version
DBeaver	CloudBeaver	Affected: 0 , ≤ 25.3.5 (semver)

Date Public

2026-10-10 00:00

Credits

HaiND from the Post and Telecommunication Institute of Technology

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-108742",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-13T19:45:59.359764Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-13T19:46:24.849Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://hackmd.io/@haind03/cve-2026-108742-cloudbeaver-initconnection-shared-credential-authz-bypass"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:github/dbeaver/cloudbeaver",
          "product": "CloudBeaver",
          "repo": "https://github.com/dbeaver/cloudbeaver",
          "vendor": "DBeaver",
          "versions": [
            {
              "lessThanOrEqual": "25.3.5",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "HaiND from the Post and Telecommunication Institute of Technology"
        }
      ],
      "datePublic": "2026-10-10T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "CloudBeaver through 25.3.5 contains a missing authorization vulnerability in the initConnection GraphQL mutation that lets view-only shared-project members persist credentials without datasource-edit permission. Attackers can set saveCredentials and sharedCredentials flags with chosen authProperties so other users connect to the shared connection under the attacker\u0027s database identity."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-11T12:19:46.154Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://hackmd.io/@haind03/cloudbeaver-initconnection-shared-credential-authz-bypass"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/dbeaver/cloudbeaver/blob/48885c48f5fbd363bf3391f47a669629b4f3dd24/server/bundles/io.cloudbeaver.server/src/io/cloudbeaver/service/core/DBWServiceCore.java#L130-L140"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/dbeaver/cloudbeaver/blob/48885c48f5fbd363bf3391f47a669629b4f3dd24/server/bundles/io.cloudbeaver.server/src/io/cloudbeaver/service/core/impl/WebServiceCore.java#L349-L480"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/dbeaver/cloudbeaver"
        },
        {
          "name": "VulnCheck Advisory: CloudBeaver through 25.3.5 Missing Authorization via initConnection GraphQL Mutation",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/cloudbeaver-through-25.3.5-missing-authorization-via-initconnection-graphql-mutation"
        }
      ],
      "title": "CloudBeaver through 25.3.5 Missing Authorization via initConnection GraphQL Mutation",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-108742",
    "datePublished": "2026-10-11T12:19:46.154Z",
    "dateReserved": "2026-10-11T01:53:16.533Z",
    "dateUpdated": "2026-10-13T19:46:24.849Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Find a vulnerability

Search criteria

10 vulnerabilities found for cloudbeaver by dbeaver

CVE-2026-63664 (GCVE-0-2026-63664)

CVE-2026-63663 (GCVE-0-2026-63663)

CVE-2026-55449 (GCVE-0-2026-55449)

CVE-2026-108745 (GCVE-0-2026-108745)

CVE-2026-108742 (GCVE-0-2026-108742)

CVE-2026-63663 (GCVE-0-2026-63663)

CVE-2026-63664 (GCVE-0-2026-63664)

CVE-2026-55449 (GCVE-0-2026-55449)

CVE-2026-108745 (GCVE-0-2026-108745)

CVE-2026-108742 (GCVE-0-2026-108742)