CVE-2026-63307 is an authorization bypass vulnerability in OtterMind's Chat2DB product before version 5.3.0. The issue exists in the GET /api/connection/datasource/{id} endpoint, where the handler calls dataSourceService.queryExistent(id, ...) without verifying if the requesting user owns the datasource. Consequently, authenticated non-admin users can enumerate datasource IDs and access decrypted passwords of other users' datasources, exposing sensitive database credentials.

An attacker with any authenticated non-admin access can enumerate datasource identifiers and obtain plaintext database credentials of datasources belonging to other users. This exposure can lead to unauthorized access to backend databases, potentially compromising sensitive data and system integrity. The vulnerability does not require administrative privileges or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected endpoint to trusted users only and monitor for suspicious activity involving datasource enumeration. Avoid granting unnecessary datasource access permissions to non-admin users.