CVE-2026-111695 Details

A vulnerability allowing insecure direct object reference (IDOR) has been identified in Shaiwz Data-Platform-Open, specifically in the version through commit efeacd3. This vulnerability enables authenticated workspace members to access datasources of other workspaces by using numeric IDs. Attackers can exploit this by sending foreign sequential IDs to various endpoints, including '/datasource/detail', '/listSchemaTable', '/tableDetail', '/update', or '/delete'. This exploitation can lead to unauthorized access to JDBC credentials, enumeration of database schemas, and the ability to modify or delete datasources.

It is recommended to implement proper workspace ownership checks in the datasource API endpoints to ensure that users can only access datasources belonging to their own workspace. Additionally, the hardcoded AES key should be removed or replaced with a generated key to enhance security.