Live › vulnerability › CVE-2026-111695
Go to dashboardShaiwz data-platform-open through commit efeacd3 lets any authenticated workspace member read, change or delete datasources belonging to other workspaces by guessing sequential numeric ids. An attacker can obtain JDBC credentials and enumerate database schemas through the datasource endpoints.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams that self-host data-platform-open with more than one workspace and let members who are not fully trusted log in. Single-workspace deployments with only trusted members have a much smaller exposure. Hosts that do not run this project can skip it.
No product ranges from the sources yet.
git -C <install-dir> rev-parse --short HEAD (unknown if the sources do not give a fixed commit)/datasource/detail with an id from another workspace (unknown whether the sources give a test request)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Shaiwz data-platform-open through commit efeacd3 contains an insecure direct object reference vulnerability that allows authenticated workspace members to access other workspaces' datasources by numeric id. Attackers can send foreign sequential ids to /datasource/detail, /listSchemaTable, /tableDetail, /update or /delete to obtain JDBC credentials, enumerate database schemas, and modify or delete datasources.
This page as .md · .json · in your agent: get_signal("CVE-2026-111695")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.