Live › vulnerability › CVE-2026-111614
Go to dashboardSelf-hosted DataCap (devlive-community, also MetaForge) 2025.1.1 and earlier: any logged-in user can read other users' datasources, snippets and dashboards by numeric id through the inherited GET /{id} handler (BaseController.getInfoForPath), exposing datasource host, port, username and cleartext password. Exposed: multi-user installs, especially with self-registration on. Single-user or fully trusted-user installs can mostly skip it. No fix found; no known exploitation or public PoC.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
DataCap installations through 2025.1.1 where more than one user has an account. Exposure comes from the source, snippet and dashboard endpoints being reachable by any authenticated low-privileged user; a single-user deployment has no other users to read from.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| DataCap | vendor | <= 2025.1.1 | – |
2025.1.1 or earlier is affected2025.1.1, which is affected)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
DataCap through 2025.1.1 contains an insecure direct object reference vulnerability in BaseController.getInfoForPath that allows authenticated users to read other users' datasources, snippets and dashboards by numeric id. Low-privileged attackers can enumerate auto-increment ids on the source, snippet and dashboard endpoints to retrieve serialized datasource host, port, username and cleartext passwords.
This page as .md · .json · in your agent: get_signal("CVE-2026-111614")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.