{"id":"CVE-2026-63664","kind":"vulnerability","aliases":["CVE-2026-63664"],"related":[],"title":"CloudBeaver: server-side export ignores admin's global export restriction","description":"CloudBeaver is a cloud database manager. In versions up to and including 26.1.1, some server-side export operations do not consistently enforce the global data export restriction. An authenticated non-administrative user with access to a shared database connection can initiate certain server-side data exports even when an administrator has disabled exports. This can disclose database contents that the user is permitted to query but is not permitted to export. The issue does not grant additional database read privileges. It is fixed in 26.1.2 by consistently enforcing the global restriction for server-side exports.","summary":"CloudBeaver, a web database manager, fails to enforce the administrator's global data export restriction on some server-side exports. An authenticated non-admin user with a shared connection can export database contents they can query but are not allowed to export.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["cloudbeaver","database","package","self-hosted"],"not_affected_if":["auth-required","default-config"],"how_to_check":"- Check the CloudBeaver version in the deployment; versions up to and including `26.1.1` are affected\n- Check whether the administrator has disabled data exports globally and whether non-admin users have shared database connections","fix":"- CloudBeaver: move to `26.1.2` or later","status":"open","published_at":"2026-11-06T20:17:24+00:00","first_seen_at":"2026-11-06T20:44:00+00:00","triaged_at":"2026-11-06T20:44:17+00:00","updated_at":"2026-11-06T20:44:17+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-06T20:44:17Z","model":"claude-haiku-5-5","output":{"fix":"- CloudBeaver: move to `26.1.2` or later","reach":"network","title":"CloudBeaver: server-side export ignores admin's global export restriction","impact":"medium","summary":"CloudBeaver, a web database manager, fails to enforce the administrator's global data export restriction on some server-side exports. An authenticated non-admin user with a shared connection can export database contents they can query but are not allowed to export.","audience":"businesses","category":"package","nicknames":[],"who_cares":["cloudbeaver","self-hosted","database"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"authenticated users export database contents they should not export","analyst_note":"","how_to_check":"- Check the CloudBeaver version in the deployment; versions up to and including `26.1.1` are affected\n- Check whether the administrator has disabled data exports globally and whether non-admin users have shared database connections","plain_action":"","needs_analyst":false,"not_affected_if":["auth-required","default-config"],"who_is_affected":"Teams that run CloudBeaver on their own servers with a global export restriction turned on and non-admin users who have shared database connections. An attacker needs a valid login; the issue does not add read access to data the user can already query. Deployments on managed hosting or with no shared connections for non-admin users have less exposure.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000679,"input_tokens":4303,"output_tokens":498,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-63664':14A,17A '26.1.1':80C '26.1.2':155C 'access':103C 'addit':147C 'admin':7A,49B 'administr':33B,100C,120C 'allow':65B 'authent':46B,97C 'certain':111C 'cloud':71C 'cloudbeav':1A,18B,24B,68C 'connect':54B,108C 'consist':89C,157C 'content':58B,128C 'cve':12A,15A 'data':36B,93C,115C 'databas':19B,27B,57B,72C,107C,127C,148C 'disabl':122C 'disclos':126C 'enforc':31B,90C,158C 'even':117C 'export':5A,10A,37B,44B,56B,67B,85C,94C,116C,123C,141C,166C 'fail':29B 'fix':153C 'global':9A,35B,92C,160C 'grant':146C 'host':23B 'ignor':6A 'includ':79C 'initi':110C 'issu':143C 'manag':28B,73C 'non':48B,99C 'non-admin':47B 'non-administr':98C 'oper':86C 'packag':20B 'permit':133C,139C 'privileg':150C 'queri':61B,135C 'read':149C 'restrict':11A,38B,95C,161C 'self':22B 'self-host':21B 'server':3A,42B,83C,113C,164C 'server-sid':2A,41B,82C,112C,163C 'share':53B,106C 'side':4A,43B,84C,114C,165C 'user':50B,101C,131C 'version':75C 'web':26B","nicknames":[],"mitigations":[],"who_affected":"Teams that run CloudBeaver on their own servers with a global export restriction turned on and non-admin users who have shared database connections. An attacker needs a valid login; the issue does not add read access to data the user can already query. Deployments on managed hosting or with no shared connections for non-admin users have less exposure.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["cloudbeaver","database","medium","package","selfhosted"],"campaign_type":null,"search_a":"'-2026':13A,16A '-63664':14A,17A 'admin':7A 'cloudbeav':1A 'cve':12A,15A 'export':5A,10A 'global':9A 'ignor':6A 'restrict':11A 'server':3A 'server-sid':2A 'side':4A","search_b":"'admin':49B 'administr':33B 'allow':65B 'authent':46B 'cloudbeav':18B,24B 'connect':54B 'content':58B 'data':36B 'databas':19B,27B,57B 'enforc':31B 'export':37B,44B,56B,67B 'fail':29B 'global':35B 'host':23B 'manag':28B 'non':48B 'non-admin':47B 'packag':20B 'queri':61B 'restrict':38B 'self':22B 'self-host':21B 'server':42B 'server-sid':41B 'share':53B 'side':43B 'user':50B 'web':26B","search_c":"'26.1.1':80C '26.1.2':155C 'access':103C 'addit':147C 'administr':100C,120C 'authent':97C 'certain':111C 'cloud':71C 'cloudbeav':68C 'connect':108C 'consist':89C,157C 'content':128C 'data':93C,115C 'databas':72C,107C,127C,148C 'disabl':122C 'disclos':126C 'enforc':90C,158C 'even':117C 'export':85C,94C,116C,123C,141C,166C 'fix':153C 'global':92C,160C 'grant':146C 'includ':79C 'initi':110C 'issu':143C 'manag':73C 'non':99C 'non-administr':98C 'oper':86C 'permit':133C,139C 'privileg':150C 'queri':135C 'read':149C 'restrict':95C,161C 'server':83C,113C,164C 'server-sid':82C,112C,163C 'share':106C 'side':84C,114C,165C 'user':101C,131C 'version':75C","first_public_at":"2026-09-25T06:56:54+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-63664","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63664","severity":null,"published_at":"2026-11-06T20:17:24+00:00","modified_at":"2026-11-06T20:17:24+00:00","first_seen_at":"2026-11-06T20:44:00+00:00","fetched_at":"2026-11-06T20:44:00+00:00","note":null}],"documents":[{"id":89809,"url":"https://github.com/dbeaver/cloudbeaver/commit/58f51ee5f6fc1e93b14f4d96c1f75fbcc13407e9","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":89810,"url":"https://github.com/dbeaver/cloudbeaver/security/advisories/GHSA-9vv7-rf3x-8xr8","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-09-25T06:56:54+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}