Description
CloudBeaver through 25.3.5 contains a missing authorization vulnerability in the initConnection GraphQL mutation that lets view-only shared-project members persist credentials without datasource-edit permission. Attackers can set saveCredentials and sharedCredentials flags with chosen authProperties so other users connect to the shared connection under the attacker's database identity.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
DBeaver CloudBeaver
Default version status: unaffected
0 to ≤ 25.3.5affected
pkg:github/dbeaver/cloudbeaverReferences
- https://hackmd.io/@haind03/cloudbeaver-initconnection-shared-credential-authz-bypass ↗
- https://github.com/dbeaver/cloudbeaver/blob/48885c48f5fbd363bf3391f47a669629b4f3dd24/server/bundles/io.cloudbeaver.server/src/io/cloudbeaver/service/core/DBWServiceCore.java#L130-L140 ↗
- https://github.com/dbeaver/cloudbeaver/blob/48885c48f5fbd363bf3391f47a669629b4f3dd24/server/bundles/io.cloudbeaver.server/src/io/cloudbeaver/service/core/impl/WebServiceCore.java#L349-L480 ↗
- https://github.com/dbeaver/cloudbeaver ↗
- https://www.vulncheck.com/advisories/cloudbeaver-through-25.3.5-missing-authorization-via-initconnection-graphql-mutation ↗
- https://hackmd.io/@haind03/cve-2026-108742-cloudbeaver-initconnection-shared-credential-authz-bypass ↗