CVE-2026-108742 Details

A missing authorization vulnerability has been identified in CloudBeaver versions through 25.3.5. The issue resides in the initConnection GraphQL mutation, where view-only shared-project members can persist credentials without having datasource-edit permission. Attackers can exploit this by setting the saveCredentials and sharedCredentials flags with chosen authentication properties, enabling other users to connect to the shared database under the attacker's identity.

The vulnerability can be addressed by adding the @WebProjectAction annotation to the initConnection method, requiring the datasource-edit permission for credential-saving actions. Additionally, the server-side logic should be updated to enforce the administrator's credential-saving policy, ensuring that direct GraphQL calls cannot override this setting.