CVE-2026-111614
Received Received - Intake

Insecure Direct Object Reference in DataCap Exposes Sensitive Data

Publication date: 2026-10-16

Last updated on: 2026-10-16

Assigner: VulnCheck

Description
DataCap through 2025.1.1 contains an insecure direct object reference vulnerability in BaseController.getInfoForPath that allows authenticated users to read other users' datasources, snippets and dashboards by numeric id. Low-privileged attackers can enumerate auto-increment ids on the source, snippet and dashboard endpoints to retrieve serialized datasource host, port, username and cleartext passwords.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-16
Last Modified
2026-10-16
Generated
2026-10-16
AI Q&A
2026-10-16
EPSS Evaluated
N/A
NVD
CVE-2026-111614
EUVD
EUVD-2026-103036

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
devlive-community DataCap 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

DataCap through 2025.1.1 has an insecure direct object reference vulnerability in the BaseController.getInfoForPath function. This flaw allows authenticated users to access other users' datasources, snippets, and dashboards by guessing or enumerating numeric IDs. Attackers with low privileges can exploit this to retrieve sensitive information like datasource host, port, username, and even cleartext passwords.

Detection Guidance

Check for unauthorized access to datasources, snippets, or dashboards by monitoring requests to endpoints like /api/datasources, /api/snippets, and /api/dashboards. Look for sequential numeric IDs in URLs or API responses that expose sensitive data.

Impact Analysis

If you are a DataCap user, this vulnerability could allow attackers to access your sensitive data, including datasource credentials. Even low-privileged users could enumerate IDs to steal host details, ports, usernames, and passwords, potentially leading to further unauthorized access or data breaches.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection principles and HIPAA's security rules. It may result in data breaches, non-compliance with access controls, and potential legal penalties due to exposure of personal or health information.

Mitigation Strategies

Upgrade DataCap to a patched version beyond 2025.1.1. Implement access controls to restrict enumeration of auto-increment IDs. Review and rotate exposed credentials for datasources. Monitor logs for suspicious access patterns.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-111614. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart