CVE-2026-111614: Authorization Bypass Through User-Controlled Key in devlive-community DataCap

CVE-2026-111614 is an authorization bypass vulnerability in devlive-community's DataCap product through version 2025.1.1. The issue exists in the BaseController.getInfoForPath method, which does not properly restrict access to user-specific resources. Authenticated low-privileged attackers can enumerate auto-incremented numeric IDs on source, snippet, and dashboard endpoints to access serialized sensitive data including host, port, username, and plaintext passwords belonging to other users.

An attacker with low privileges can read sensitive configuration data of other users, including datasource connection details and cleartext passwords. This exposure can lead to further compromise of user accounts or connected systems. The vulnerability has a CVSS 4.0 base score of 7.1 (high severity), indicating a significant risk due to network attack vector, low attack complexity, no user interaction required, and high impact on confidentiality.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the affected endpoints to trusted users only and monitor for suspicious enumeration activity. Avoid exposing numeric IDs in URLs or API responses if possible.