CVE-2026-63664 · Package
NO FIX YET · SEE WHAT TO DO
CloudBeaver, a web database manager, fails to enforce the administrator's global data export restriction on some server-side exports. An authenticated non-admin user with a shared connection can export database contents they can query but are not allowed to export.
first public Sep 25, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Teams that run CloudBeaver on their own servers with a global export restriction turned on and non-admin users who have shared database connections. An attacker needs a valid login; the issue does not add read access to data the user can already query. Deployments on managed hosting or with no shared connections for non-admin users have less exposure.
Not affected if auth-required, default-config
Who cares cloudbeaver, database, self-hosted
26.1.1 are affected26.1.2 or laterCloudBeaver is a cloud database manager. In versions up to and including 26.1.1, some server-side export operations do not consistently enforce the global data export restriction. An authenticated non-administrative user with access to a shared database connection can initiate certain server-side data exports even when an administrator has disabled exports. This can disclose database contents that the user is permitted to query but is not permitted to export. The issue does not grant additional database read privileges. It is fixed in 26.1.2 by consistently enforcing the global restriction for server-side exports.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.