CVE-2026-108742: fallo de gravedad media en DBeaver CloudBeaver
CloudBeaver through 25.3.5 Missing Authorization via initConnection GraphQL Mutation
Publicada el
10Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 5.3
probabilidad de explotación
—
explotación observada
noninguna fuente lo reporta
CloudBeaver through 25.3.5 contains a missing authorization vulnerability in the initConnection GraphQL mutation that lets view-only shared-project members persist credentials without datasource-edit permission. Attackers can set saveCredentials and sharedCredentials flags with chosen authProperties so other users connect to the shared connection under the attacker's database identity.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Productos afectados
DBeaver · CloudBeaverCVEs relacionadas — DBeaver CloudBeaver
En el mismo producto, de las más peligrosas a las menos.
Referencias
https://github.com/dbeaver/cloudbeaverhttps://github.com/dbeaver/cloudbeaver/blob/48885c48f5fbd363bf3391f47a669629b4f3dd24/server/bundles/io.cloudbeaver.server/src/io/cloudbeaver/service/core/DBWServiceCore.java#L130-L140https://github.com/dbeaver/cloudbeaver/blob/48885c48f5fbd363bf3391f47a669629b4f3dd24/server/bundles/io.cloudbeaver.server/src/io/cloudbeaver/service/core/impl/WebServiceCore.java#L349-L480https://hackmd.io/@haind03/cloudbeaver-initconnection-shared-credential-authz-bypasshttps://www.vulncheck.com/advisories/cloudbeaver-through-25.3.5-missing-authorization-via-initconnection-graphql-mutation