CVE-2026-111695

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-111695

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-111695.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-111695

Published

2026-10-16T17:39:50Z

Modified

2026-10-17T02:48:23Z

Severity

7.1 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N CVSS Calculator

Summary

Shaiwz data-platform-open through commit efeacd3 IDOR in Datasource API

Details

Shaiwz data-platform-open through commit efeacd3 contains an insecure direct object reference vulnerability that allows authenticated workspace members to access other workspaces' datasources by numeric id. Attackers can send foreign sequential ids to /datasource/detail, /listSchemaTable, /tableDetail, /update or /delete to obtain JDBC credentials, enumerate database schemas, and modify or delete datasources.

Database specific

{
    "cna_assigner":  "VulnCheck",
    "cwe_ids":  [
        "CWE-639"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/111xxx/CVE-2026-111695.json"
}

References

Affected packages

Git / github.com/shaiwz/data-platform-open

Affected ranges

Type: GIT
Repo: https://github.com/shaiwz/data-platform-open
Events: Introduced

0 Unknown introduced commit / All previous commits are affected

Last Affected

efeacd35e8450b7a084fa2134d292cd058cf605b

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-111695.json"