CVE-2026-111614 Details

A vulnerability exists in DataCap versions through 2025.1.1, specifically within the BaseController.getInfoForPath method. This insecure direct object reference (IDOR) vulnerability enables authenticated users to access and read the datasources, snippets, and dashboards of other users by exploiting numeric IDs. Low-privileged attackers can enumerate auto-incrementing IDs on the source, snippet, and dashboard endpoints to extract serialized information, including datasource host, port, username, and cleartext passwords.

The vulnerability can be addressed by implementing proper ownership checks in the 'getInfoForPath' method to ensure that users can only access their own resources. Additionally, sensitive information such as datasource passwords should be encrypted and not included in response bodies.