CVE-2026-108742: Missing Authorization in DBeaver CloudBeaver

CVE-2026-108742 describes a missing authorization vulnerability in CloudBeaver through version 25.3.5. The vulnerability exists in the initConnection GraphQL mutation, where view-only shared-project members can set saveCredentials and sharedCredentials flags with chosen authentication properties. This allows them to persist credentials despite lacking datasource-edit permissions, enabling other users to connect to the shared connection under the attacker's database identity. The CVSS 4.0 base score is 5.3 (medium severity), indicating a network attack vector with low privileges required and no user interaction needed.

An attacker with view-only shared-project membership can persist credentials without proper authorization, potentially causing other users to connect to the database using the attacker's credentials. This could lead to unauthorized database access under the attacker's identity, undermining access controls and trust boundaries within shared projects.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict shared-project membership to trusted users and monitor for suspicious credential persistence activities related to shared connections.