{"id":"CVE-2026-55449","kind":"vulnerability","aliases":["CVE-2026-55449"],"related":[],"title":"CloudBeaver: crafted project name lets an authenticated user list server directories","description":"CloudBeaver is a cloud database manager. Prior to 26.1.2, its resource-management project resolution accepts project identifiers without validating that they are safe path components. An authenticated user with resource-management privileges can supply a crafted project identifier that causes path resolution to escape the shared-projects directory and enumerate directory names elsewhere on the server. This can disclose filesystem layout information. Arbitrary file reads, writes, and deletion are not confirmed. The issue is fixed in 26.1.2 by validating project names before resolving the shared-project path.","summary":"CloudBeaver, a cloud database manager, does not validate project identifiers before resolving shared-project paths. An authenticated user with resource-management privileges can use a crafted identifier to escape the shared-projects directory and enumerate directory names elsewhere on the server.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["cloudbeaver","database-tools","package","self-hosted"],"not_affected_if":["no-resource-management-users","unauthenticated-only-access"],"how_to_check":"- Check the installed CloudBeaver version and compare it with `26.1.2`.\n- Confirm whether resource-management privileges are granted to any non-admin users.","fix":"- CloudBeaver: move to `26.1.2` or later.","status":"open","published_at":"2026-11-06T20:17:22+00:00","first_seen_at":"2026-11-06T20:43:59+00:00","triaged_at":"2026-11-06T20:44:19+00:00","updated_at":"2026-11-06T20:44:19+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-06T20:44:19Z","model":"claude-haiku-5-5","output":{"fix":"- CloudBeaver: move to `26.1.2` or later.","reach":"network","title":"CloudBeaver: crafted project name lets an authenticated user list server directories","impact":"low","summary":"CloudBeaver, a cloud database manager, does not validate project identifiers before resolving shared-project paths. An authenticated user with resource-management privileges can use a crafted identifier to escape the shared-projects directory and enumerate directory names elsewhere on the server.","audience":"businesses","category":"package","nicknames":[],"who_cares":["cloudbeaver","self-hosted","database-tools"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"Directory names outside shared projects are enumerated; arbitrary file access is unconfirmed.","analyst_note":"","how_to_check":"- Check the installed CloudBeaver version and compare it with `26.1.2`.\n- Confirm whether resource-management privileges are granted to any non-admin users.","plain_action":"","needs_analyst":false,"not_affected_if":["unauthenticated-only-access","no-resource-management-users"],"who_is_affected":"Teams that run a self-hosted CloudBeaver instance with resource-management features and users who hold resource-management privileges. The flaw needs a logged-in account, so instances without such users are at lower risk. Managed hosting by others is outside this scope unless the operator has not patched.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000695,"input_tokens":4314,"output_tokens":527,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-55449':14A,17A '26.1.2':78C,149C 'accept':85C 'arbitrari':135C 'authent':7A,43B,97C 'caus':111C 'cloud':28B,73C 'cloudbeav':1A,18B,26B,70C 'compon':95C 'confirm':143C 'craft':2A,53B,107C 'cve':12A,15A 'databas':20B,29B,74C 'database-tool':19B 'delet':140C 'directori':11A,61B,64B,120C,123C 'disclos':131C 'elsewher':66B,125C 'enumer':63B,122C 'escap':56B,115C 'file':136C 'filesystem':132C 'fix':147C 'host':25B 'identifi':35B,54B,87C,109C 'inform':134C 'issu':145C 'layout':133C 'let':5A 'list':9A 'manag':30B,48B,75C,82C,102C 'name':4A,65B,124C,153C 'packag':22B 'path':41B,94C,112C,160C 'prior':76C 'privileg':49B,103C 'project':3A,34B,40B,60B,83C,86C,108C,119C,152C,159C 'read':137C 'resolut':84C,113C 'resolv':37B,155C 'resourc':47B,81C,101C 'resource-manag':46B,80C,100C 'safe':93C 'self':24B 'self-host':23B 'server':10A,69B,128C 'share':39B,59B,118C,158C 'shared-project':38B,58B,117C,157C 'suppli':105C 'tool':21B 'use':51B 'user':8A,44B,98C 'valid':33B,89C,151C 'without':88C 'write':138C","nicknames":[],"mitigations":[],"who_affected":"Teams that run a self-hosted CloudBeaver instance with resource-management features and users who hold resource-management privileges. The flaw needs a logged-in account, so instances without such users are at lower risk. Managed hosting by others is outside this scope unless the operator has not patched.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["cloudbeaver","databasetools","medium","package","selfhosted"],"campaign_type":null,"search_a":"'-2026':13A,16A '-55449':14A,17A 'authent':7A 'cloudbeav':1A 'craft':2A 'cve':12A,15A 'directori':11A 'let':5A 'list':9A 'name':4A 'project':3A 'server':10A 'user':8A","search_b":"'authent':43B 'cloud':28B 'cloudbeav':18B,26B 'craft':53B 'databas':20B,29B 'database-tool':19B 'directori':61B,64B 'elsewher':66B 'enumer':63B 'escap':56B 'host':25B 'identifi':35B,54B 'manag':30B,48B 'name':65B 'packag':22B 'path':41B 'privileg':49B 'project':34B,40B,60B 'resolv':37B 'resourc':47B 'resource-manag':46B 'self':24B 'self-host':23B 'server':69B 'share':39B,59B 'shared-project':38B,58B 'tool':21B 'use':51B 'user':44B 'valid':33B","search_c":"'26.1.2':78C,149C 'accept':85C 'arbitrari':135C 'authent':97C 'caus':111C 'cloud':73C 'cloudbeav':70C 'compon':95C 'confirm':143C 'craft':107C 'databas':74C 'delet':140C 'directori':120C,123C 'disclos':131C 'elsewher':125C 'enumer':122C 'escap':115C 'file':136C 'filesystem':132C 'fix':147C 'identifi':87C,109C 'inform':134C 'issu':145C 'layout':133C 'manag':75C,82C,102C 'name':124C,153C 'path':94C,112C,160C 'prior':76C 'privileg':103C 'project':83C,86C,108C,119C,152C,159C 'read':137C 'resolut':84C,113C 'resolv':155C 'resourc':81C,101C 'resource-manag':80C,100C 'safe':93C 'server':128C 'share':118C,158C 'shared-project':117C,157C 'suppli':105C 'user':98C 'valid':89C,151C 'without':88C 'write':138C","first_public_at":"2026-07-02T17:15:17+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-55449","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55449","severity":null,"published_at":"2026-11-06T20:17:22+00:00","modified_at":"2026-11-06T20:17:23+00:00","first_seen_at":"2026-11-06T20:43:59+00:00","fetched_at":"2026-11-06T20:43:59+00:00","note":null}],"documents":[{"id":89796,"url":"https://github.com/dbeaver/cloudbeaver/commit/a333e5841a18b38c82d3769a55974700108cedbe","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":89797,"url":"https://github.com/dbeaver/cloudbeaver/security/advisories/GHSA-6x6p-mrpr-wfq9","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-07-02T17:15:17+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}