CVE-2026-111631

Name of the Vulnerable Software and Affected Versions Distributor versions prior to 2.3.2

Description Missing authorization allows users with Contributor-level privileges to invoke external connection AJAX actions reserved for users with manage options permissions. An attacker can call the dt verify external connection() function by providing a specific endpointId and url to transmit stored connection credentials to a server under their control. Additionally, the dt begin authorization() function can be abused to create unauthorized connections.

Recommendations Update to version 2.3.2 or later.