---
id: "CVE-2026-111614"
kind: "vulnerability"
aliases: ["CVE-2026-111614"]
title: "DataCap: authenticated users can read other users' datasource credentials by id"
severity: "high"
cvss: 7.1
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "DataCap", "fixed": [], "affected": "<= 2025.1.1", "ecosystem": "vendor"}]
ecosystems: []
tags: ["auth-required", "credentials", "datacap", "idor", "java", "package", "self-hosted"]
not_affected_if: ["auth-required", "registration-disabled", "single-user"]
published_at: "2026-10-16T18:17:40+00:00"
first_seen_at: "2026-10-23T21:57:13+00:00"
updated_at: "2026-10-25T03:46:59+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111614", "first_seen_at": "2026-10-23T21:57:13+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-25T03:46:59+00:00"}]
---

# DataCap: authenticated users can read other users' datasource credentials by id

Self-hosted DataCap (devlive-community, also MetaForge) 2025.1.1 and earlier: any logged-in user can read other users' datasources, snippets and dashboards by numeric id through the inherited GET /{id} handler (BaseController.getInfoForPath), exposing datasource host, port, username and cleartext password. Exposed: multi-user installs, especially with self-registration on. Single-user or fully trusted-user installs can mostly skip it. No fix found; no known exploitation or public PoC.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:DataCap affected <= 2025.1.1 fixed ?

## How to check

Check your DataCap version: 2025.1.1 or earlier is affected. Test: logged in as a non-owner user, GET /api/v2/source/<id> (also /api/v1/snippet/<id>, /api/v1/dashboard/<id>) for an id you do not own; if it returns another user's record, you are exposed.

## Fix

No fixed version known as of 2026-10-25 (latest release found is 2025.1.1, which is affected). Interim: restrict DataCap to trusted users, disable self-registration (datacap.registration.enable=false), block GET on /api/v*/source/{id}, /snippet/{id}, /dashboard/{id} at a reverse proxy, and rotate the passwords of datasources stored in DataCap if untrusted users have had accounts.

## Timeline

- 2026-10-23T21:57:13+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-111614
- 2026-10-25T03:46:59+00:00 analyst — Read NVD, VulnCheck CNA advisory and researcher writeup (static analysis only, no runtime test, no PoC). No fixed release found: latest listed release is 2025.1.1 (affected); no vendor advisory seen. Nothing marked verified (no vendor-own text).

## Documents

- [advisory] VulnCheck: DataCap through 2025.1.1 IDOR via BaseController.getInfoForPath https://www.vulncheck.com/advisories/datacap-through-2025.1.1-idor-via-basecontroller-getinfoforpath-exposes-credentials
- [describes] hieuPenguinnn: DataCap cross-user datasource disclosure via get-by-id (static analysis, not runtime-tested) https://hackmd.io/@hieuPenguinnn/metaforge-datacap-source-getbyid-cross-user-idor
- [mentions] DataCap releases (latest listed: 2025.1.1) https://github.com/devlive-community/MetaForge/releases

## From the sources

DataCap through 2025.1.1 contains an insecure direct object reference vulnerability in BaseController.getInfoForPath that allows authenticated users to read other users' datasources, snippets and dashboards by numeric id. Low-privileged attackers can enumerate auto-increment ids on the source, snippet and dashboard endpoints to retrieve serialized datasource host, port, username and cleartext passwords.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_