CVE-2026-108742

Name of the Vulnerable Software and Affected Versions CloudBeaver versions prior to 25.3.6

Description A missing authorization issue exists in the initConnection GraphQL mutation. This allows members of a shared project with view-only permissions to persist credentials even without the required datasource-edit permission. An attacker can manipulate the saveCredentials and sharedCredentials flags using specific authProperties, causing other users to connect to the shared connection using the attacker's database identity.

Recommendations Update to version 25.3.6 or later.