{"id":"CVE-2026-111695","kind":"vulnerability","aliases":["CVE-2026-111695"],"related":[],"title":"Shaiwz data-platform-open: workspace members reach other workspaces' datasources by id","description":"Shaiwz data-platform-open through commit efeacd3 contains an insecure direct object reference vulnerability that allows authenticated workspace members to access other workspaces' datasources by numeric id. Attackers can send foreign sequential ids to /datasource/detail, /listSchemaTable, /tableDetail, /update or /delete to obtain JDBC credentials, enumerate database schemas, and modify or delete datasources.","summary":"Shaiwz data-platform-open through commit efeacd3 lets any authenticated workspace member read, change or delete datasources belonging to other workspaces by guessing sequential numeric ids. An attacker can obtain JDBC credentials and enumerate database schemas through the datasource endpoints.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["data-platform-open","jdbc","multi-tenant","package","self-hosted"],"not_affected_if":["single-workspace","trusted-members-only"],"how_to_check":"- Confirm whether the deployment runs data-platform-open and what commit it was built from, e.g. `git -C <install-dir> rev-parse --short HEAD` (unknown if the sources do not give a fixed commit)\n- Check whether ordinary users can call `/datasource/detail` with an id from another workspace (unknown whether the sources give a test request)","fix":"- Upgrade data-platform-open to a commit after efeacd3 once a fixed release is published (unknown: the sources do not name a fixed version)\n- Until patched, restrict workspace membership to trusted users and rotate JDBC credentials stored in datasources","status":"open","published_at":"2026-10-16T18:17:53+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","triaged_at":"2026-10-25T03:36:31+00:00","updated_at":"2026-10-25T03:36:31+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T03:36:31Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade data-platform-open to a commit after efeacd3 once a fixed release is published (unknown: the sources do not name a fixed version)\n- Until patched, restrict workspace membership to trusted users and rotate JDBC credentials stored in datasources","reach":"internet","title":"Shaiwz data-platform-open: workspace members reach other workspaces' datasources by id","impact":"high","summary":"Shaiwz data-platform-open through commit efeacd3 lets any authenticated workspace member read, change or delete datasources belonging to other workspaces by guessing sequential numeric ids. An attacker can obtain JDBC credentials and enumerate database schemas through the datasource endpoints.","category":"package","nicknames":[],"who_cares":["data-platform-open","self-hosted","multi-tenant","jdbc"],"confidence":0.6,"needs_auth":"yes","worst_case":"Attacker reads JDBC credentials and modifies or deletes other workspaces' datasources","analyst_note":"Find the upstream repository's fix commit or release after efeacd3 and confirm which endpoints were patched; the NVD entry gives no fixed version.","how_to_check":"- Confirm whether the deployment runs data-platform-open and what commit it was built from, e.g. `git -C <install-dir> rev-parse --short HEAD` (unknown if the sources do not give a fixed commit)\n- Check whether ordinary users can call `/datasource/detail` with an id from another workspace (unknown whether the sources give a test request)","needs_analyst":true,"not_affected_if":["single-workspace","trusted-members-only"],"who_is_affected":"Teams that self-host data-platform-open with more than one workspace and let members who are not fully trusted log in. Single-workspace deployments with only trusted members have a much smaller exposure. Hosts that do not run this project can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000675,"input_tokens":3359,"output_tokens":679,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-111695':16A,19A '-2026':15A,18A '/datasource/detail':108C '/delete':113C '/listschematable':109C '/tabledetail':110C '/update':111C 'access':94C 'allow':89C 'attack':60B,101C 'authent':42B,90C 'belong':50B 'chang':46B 'commit':38B,79C 'contain':81C 'credenti':64B,117C 'cve':14A,17A 'data':3A,21B,34B,75C 'data-platform-open':2A,20B,33B,74C 'databas':67B,119C 'datasourc':11A,49B,71B,97C,125C 'delet':48B,124C 'direct':84C 'efeacd3':39B,80C 'endpoint':72B 'enumer':66B,118C 'foreign':104C 'guess':55B 'host':31B 'id':13A,58B,100C,106C 'insecur':83C 'jdbc':24B,63B,116C 'let':40B 'member':7A,44B,92C 'modifi':122C 'multi':26B 'multi-ten':25B 'numer':57B,99C 'object':85C 'obtain':62B,115C 'open':5A,23B,36B,77C 'packag':28B 'platform':4A,22B,35B,76C 'reach':8A 'read':45B 'refer':86C 'schema':68B,120C 'self':30B 'self-host':29B 'send':103C 'sequenti':56B,105C 'shaiwz':1A,32B,73C 'tenant':27B 'vulner':87C 'workspac':6A,10A,43B,53B,91C,96C","nicknames":[],"mitigations":[],"who_affected":"Teams that self-host data-platform-open with more than one workspace and let members who are not fully trusted log in. Single-workspace deployments with only trusted members have a much smaller exposure. Hosts that do not run this project can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T18:17:53+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111695","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111695","severity":null,"published_at":"2026-10-16T18:17:53+00:00","modified_at":"2026-10-19T14:16:59+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}