CVE-2026-108745: Missing Authorization in DBeaver CloudBeaver
Description
CloudBeaver versions up to 25.3.5 have a missing authorization vulnerability in the WebSQLResultServlet component. This flaw allows any authenticated web session holder to access and read other users' LOB export files stored in a shared folder. Exploitation requires guessing table and column names and enumerating timestamps to retrieve data from connections the attacker cannot normally query. The vulnerability has a low CVSS score of 2.3, indicating limited impact and exploitability.
CVSS v4.0
Score 2.3low
Affected software
DBeaver
CloudBeaver
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-108745 is a missing authorization vulnerability in CloudBeaver through version 25.3.5. The issue exists in the WebSQLResultServlet, which improperly restricts access to LOB export files in a shared folder. An authenticated user can enumerate and download large object (LOB) data belonging to other users by guessing database table and column names and enumerating second-resolution timestamps. This allows unauthorized reading of data from database connections that the attacker does not have query access to.
Potential Impact
An attacker with a valid web session can access and download other users' LOB export files, potentially exposing sensitive database content. However, the vulnerability requires some knowledge or guessing of database schema details and timestamps, limiting ease of exploitation. The CVSS score of 2.3 reflects low severity, indicating limited confidentiality impact and no integrity or availability impact.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch link is provided in the available data. Until a patch is available, restrict access to CloudBeaver instances to trusted users and monitor for unusual access patterns to shared export folders.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-10-11T01:53:20.486Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6acb85c22cdf04f656d09a2b
Added to database: 10/11/2026, 12:49:06 UTC
Last enriched: 10/11/2026, 13:03:58 UTC
Last updated: 10/11/2026, 21:33:15 UTC
Views: 15
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.