CVE-2026-108742
Received Received - Intake

Missing Authorization in CloudBeaver Lets View-Only Users Save Credentials

Publication date: 2026-10-11

Last updated on: 2026-10-11

Assigner: VulnCheck

Description
CloudBeaver through 25.3.5 contains a missing authorization vulnerability in the initConnection GraphQL mutation that lets view-only shared-project members persist credentials without datasource-edit permission. Attackers can set saveCredentials and sharedCredentials flags with chosen authProperties so other users connect to the shared connection under the attacker's database identity.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-11
Last Modified
2026-10-11
Generated
2026-10-11
AI Q&A
2026-10-11
EPSS Evaluated
N/A
NVD
CVE-2026-108742
EUVD
EUVD-2026-96908

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
DBeaver CloudBeaver 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CloudBeaver through version 25.3.5 has a missing authorization vulnerability in the initConnection GraphQL mutation. View-only shared-project members can persist credentials without datasource-edit permission by setting saveCredentials and sharedCredentials flags with chosen authProperties. This allows attackers to connect to shared connections under their database identity.

Detection Guidance

Check CloudBeaver logs for unauthorized GraphQL initConnection requests with saveCredentials and sharedCredentials flags set to true. Monitor for suspicious credential persistence in shared datasource configurations.

Impact Analysis

Attackers with view-only access can save their own credentials into shared datasource configurations. Other users accessing these connections will then use the attacker's credentials, potentially leading to unauthorized database access or data exposure. This bypasses intended permission restrictions.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements in GDPR and HIPAA. Unauthorized credential persistence may result in data breaches, triggering compliance violations and potential regulatory penalties.

Mitigation Strategies
  • Upgrade CloudBeaver to a version beyond 25.3.5 where this vulnerability is patched.
  • Review and remove any unauthorized credentials stored in shared datasource configurations.
  • Restrict view-only users from having unnecessary permissions in shared projects.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-108742. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart