CVE-2026-125380: DataRoom through 3.0.0 Incorrect Authorization via /dataRoom/dataset/run/test
DataRoom through 3.0.0 contains an incorrect authorization vulnerability in DatasetController.runTest that allows visitor-role users to execute dataset definitions supplied in the request body. Attackers can specify an arbitrary dataSourceCode and raw SELECT SQL to query any configured relational data source using its stored decrypted credentials, bypassing developer-only restrictions.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this vulnerability?
A user with the visitor role can exploit it remotely. No user interaction is required, but the attacker must be able to submit requests to the affected endpoint.
What data can an attacker access?
An attacker can provide an arbitrary dataSourceCode and raw SELECT SQL, allowing queries against any configured relational data source. The queries use the data source's stored decrypted credentials, potentially exposing confidential data available to those credentials.
Are default restrictions sufficient to prevent exploitation?
No. The issue bypasses the developer-only restriction on dataset testing because visitor-role users can invoke the vulnerable DatasetController.runTest functionality.
What can be done if an update is not immediately available?
Restrict visitor-role access to the /dataRoom/dataset/run/test endpoint and limit network access to the DataRoom service to trusted users. Review configured data sources and reduce the database privileges associated with their stored credentials where possible.
How can administrators check for attempted exploitation?
Review requests to /dataRoom/dataset/run/test for visitor-role sessions, especially request bodies containing unexpected dataSourceCode values or raw SELECT SQL. Also review database query logs for unusual SELECT activity performed through configured DataRoom data-source credentials.