Missing authorization in DBeaver CloudBeaver initConnection mutation
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- None · Low · None
- Fix status
- No fix listed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-862.
Summary
CloudBeaver through 25.3.5 contains a missing authorization flaw (CWE-862) in the initConnection GraphQL mutation. Members of a shared project with view-only access can persist credentials without datasource-edit permission. An attacker can set the saveCredentials and sharedCredentials flags so other users connect to the shared connection under the attacker's database identity.
Written with Claude Haiku 5.5 from the sources below · 2026-10-29
Description from the CNA
CloudBeaver through 25.3.5 contains a missing authorization vulnerability in the initConnection GraphQL mutation that lets view-only shared-project members persist credentials without datasource-edit permission. Attackers can set saveCredentials and sharedCredentials flags with chosen authProperties so other users connect to the shared connection under the attacker's database identity.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
The sources list no fixed version for CloudBeaver.
Written with Claude Haiku 5.5 from the sources below · 2026-10-29
Timeline
- 2026-10-11 Threatist record created from CVE-2026-108742
- 2026-10-11 Alias added: GHSA-362j-x75x-j27h
- 2026-10-13 CISA SSVC decision points changed
- 2026-10-13 Priority changed: LOW → MEDIUM
References
Other 3
- https://github.com/dbeaver/cloudbeaver/blob/48885c48f5fbd363bf3391f47a669629b4f3dd24/server/bundles/io.cloudbeaver.server/src/io/cloudbeaver/service/core/DBWServiceCore.java#L130-L140
- https://github.com/dbeaver/cloudbeaver/blob/48885c48f5fbd363bf3391f47a669629b4f3dd24/server/bundles/io.cloudbeaver.server/src/io/cloudbeaver/service/core/impl/WebServiceCore.java#L349-L480
- https://github.com/dbeaver/cloudbeaver
More dbeaver vulnerabilities
- TI-2026-86105 Path traversal in CloudBeaver lets users read server files CVSS 3.1MEDIUM 6.5
- TI-2026-86106 Authorization bypass in CloudBeaver lets users export restricted data CVSS 3.1MEDIUM 6.5
- TI-2021-02767 Improper Restriction of XML External Entity Reference in dbeaver/dbeaver CVSS 3.1MEDIUM 5.5
- TI-2026-86103 Path traversal in CloudBeaver Resource Manager exposes directory names CVSS 4.0MEDIUM 5.3
- TI-2026-70723 CloudBeaver missing authorization exposes other users' LOB exports CVSS 4.0LOW 2.3
Sources
- CVE-2026-108742 · CVE Program
- CVE-2026-108742 · NVD
- FIRST EPSS
- GHSA-362j-x75x-j27h · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences