CVE-2026-111614: DataCap through 2025.1.1 IDOR via BaseController.getInfoForPath Exposes Credentials
DataCap through 2025.1.1 contains an insecure direct object reference vulnerability in BaseController.getInfoForPath that allows authenticated users to read other users' datasources, snippets and dashboards by numeric id. Low-privileged attackers can enumerate auto-increment ids on the source, snippet and dashboard endpoints to retrieve serialized datasource host, port, username and cleartext passwords.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this vulnerability?
Any authenticated DataCap user, including a low-privileged user, can exploit it. The attacker needs access to the source, snippet, or dashboard endpoints and numeric object IDs to request.
What information can be exposed?
An attacker can retrieve other users' datasources, snippets, and dashboards. Serialized datasource details may disclose the host, port, username, and cleartext password.
Are systems affected only when a particular feature is enabled?
The available information identifies the affected source, snippet, and dashboard endpoints, but does not state that a non-default feature or configuration is required. Exploitation requires an authenticated account.
How can I determine whether data may already have been exposed?
Review requests to the source, snippet, and dashboard endpoints for enumeration of numeric IDs by accounts accessing objects owned by other users. The provided information does not specify exact endpoint paths or logging indicators.