---
id: "CVE-2026-111695"
kind: "vulnerability"
aliases: ["CVE-2026-111695"]
title: "Shaiwz data-platform-open: workspace members reach other workspaces' datasources by id"
severity: "high"
cvss: 7.1
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["data-platform-open", "jdbc", "multi-tenant", "package", "self-hosted"]
not_affected_if: ["single-workspace", "trusted-members-only"]
published_at: "2026-10-16T18:17:53+00:00"
first_seen_at: "2026-10-23T21:57:13+00:00"
updated_at: "2026-10-25T03:36:31+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111695", "first_seen_at": "2026-10-23T21:57:13+00:00"}]
---

# Shaiwz data-platform-open: workspace members reach other workspaces' datasources by id

Shaiwz data-platform-open through commit efeacd3 lets any authenticated workspace member read, change or delete datasources belonging to other workspaces by guessing sequential numeric ids. An attacker can obtain JDBC credentials and enumerate database schemas through the datasource endpoints.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Confirm whether the deployment runs data-platform-open and what commit it was built from, e.g. `git -C <install-dir> rev-parse --short HEAD` (unknown if the sources do not give a fixed commit)
- Check whether ordinary users can call `/datasource/detail` with an id from another workspace (unknown whether the sources give a test request)

## Fix

- Upgrade data-platform-open to a commit after efeacd3 once a fixed release is published (unknown: the sources do not name a fixed version)
- Until patched, restrict workspace membership to trusted users and rotate JDBC credentials stored in datasources

## Timeline

- 2026-10-23T21:57:13+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-111695

## From the sources

Shaiwz data-platform-open through commit efeacd3 contains an insecure direct object reference vulnerability that allows authenticated workspace members to access other workspaces' datasources by numeric id. Attackers can send foreign sequential ids to /datasource/detail, /listSchemaTable, /tableDetail, /update or /delete to obtain JDBC credentials, enumerate database schemas, and modify or delete datasources.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_