CVE-2026-111631: Distributor before 2.3.2 Missing Authorization in External Connection AJAX Actions
Distributor before 2.3.2 contains a missing authorization vulnerability that allows Contributor-level users to invoke external connection AJAX actions intended for manageoptions users. Attackers can call dtverifyexternalconnection with a chosen endpointId and url to send stored connection credentials to attacker-controlled servers, or abuse dtbeginauthorization to create connections.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
A user with the Contributor role can exploit it. The vulnerable AJAX actions were intended to be restricted to users with the manage_options capability.
What access does an attacker need?
The attacker needs an authenticated Contributor-level account; no user interaction is required. They can invoke the affected external connection AJAX actions over the network.
What could an attacker do with the vulnerable actions?
By calling dt_verify_external_connection with a selected endpointId and attacker-controlled URL, an attacker can cause stored connection credentials to be sent to an attacker-controlled server. They can also abuse dt_begin_authorization to create connections.
Which versions are affected?
Distributor versions before 2.3.2 are affected. Upgrading to version 2.3.2 or later addresses the affected version range.