Read the docs
TI-2026-86106 Aliases CVE-2026-63664

Authorization bypass in CloudBeaver lets users export restricted data

Priority LOW 28CWE-862Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-862.

Summary

CloudBeaver, a cloud database manager, is affected before 26.1.2. Some server-side export operations do not consistently enforce the global data export restriction, so an authenticated non-administrative user with access to a shared database connection can start certain server-side exports even after an administrator has disabled exports. This is a missing authorization check (CWE-862). The exported data is limited to contents the user may already query, and the flaw grants no additional database read privileges.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

CloudBeaver is a cloud database manager. In versions up to and including 26.1.1, some server-side export operations do not consistently enforce the global data export restriction. An authenticated non-administrative user with access to a shared database connection can initiate certain server-side data exports even when an administrator has disabled exports. This can disclose database contents that the user is permitted to query but is not permitted to export. The issue does not grant additional database read privileges. It is fixed in 26.1.2 by consistently enforcing the global restriction for server-side exports.

Why it matters now

EPSS 0.00231 13th percentileScored 2026-11-07
Fix Fixed cloudbeaver (dbeaver): 26.1.2

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
dbeavercloudbeaverbefore 26.1.226.1.2Patch availableCNA
  • cloudbeaver Vendordbeaver Affected before 26.1.2 Fixed in 26.1.2 Patch available CNA

Remediation

Upgrade CloudBeaver to version 26.1.2, which consistently enforces the global restriction for server-side exports.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

  • Fix · CNA cloudbeaver (dbeaver) Fixed in 26.1.2

Timeline

  1. 2026-11-06 Threatist record created from CVE-2026-63664
  2. 2026-11-08 Priority changed: MEDIUM → LOW

References

Other 3

  • TI-2026-70721 Missing authorization in DBeaver CloudBeaver initConnection mutation CVSS 4.0MEDIUM 5.3
  • TI-2026-86105 Path traversal in CloudBeaver lets users read server files CVSS 3.1MEDIUM 6.5
  • TI-2021-02767 Improper Restriction of XML External Entity Reference in dbeaver/dbeaver CVSS 3.1MEDIUM 5.5
  • TI-2026-86103 Path traversal in CloudBeaver Resource Manager exposes directory names CVSS 4.0MEDIUM 5.3
  • TI-2026-70723 CloudBeaver missing authorization exposes other users' LOB exports CVSS 4.0LOW 2.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences