CVE-2026-63307 describes an authorization bypass vulnerability in OtterMind's Chat2DB product before version 5.3.0. The issue exists in the GET /api/connection/datasource/{id} endpoint, where the handler calls dataSourceService.queryExistent(id, ...) without verifying if the requesting user owns the datasource. Consequently, authenticated non-admin users can enumerate datasource IDs and access decrypted passwords of datasources belonging to other users, exposing sensitive database credentials.

An attacker with valid authentication but non-admin privileges can enumerate datasource identifiers and obtain plaintext database credentials of other users' datasources. This exposure can lead to unauthorized access to backend databases, potentially compromising data confidentiality and integrity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vulnerability affects versions prior to 5.3.0, upgrading to version 5.3.0 or later is implied but not explicitly confirmed. Until an official fix is available, restrict access to the vulnerable endpoint and monitor for unauthorized access attempts.