CVE-2026-108742: CloudBeaver through 25.3.5 Missing Authorization via initConnection GraphQL Mutation
CloudBeaver through 25.3.5 contains a missing authorization vulnerability in the initConnection GraphQL mutation that lets view-only shared-project members persist credentials without datasource-edit permission. Attackers can set saveCredentials and sharedCredentials flags with chosen authProperties so other users connect to the shared connection under the attacker's database identity.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
A view-only member of a shared project can exploit it if they can invoke the initConnection GraphQL mutation for a shared connection. The attacker does not need datasource-edit permission.
What is the practical impact?
The attacker can persist chosen authentication properties by setting saveCredentials and sharedCredentials. Other users who connect through the shared connection may then authenticate to the database using the attacker's database identity.
Which versions are affected?
CloudBeaver through version 25.3.5 is affected.