Threats tagged 'ghsa-mppv-m824-3w4x'

1 threat

Severity	CVSS	Threat	Source	Published	Score and star
High	7.1	CVE-2026-125380DataRoom through 3.0.0 contains an incorrect authorization vulnerability in DatasetController.runTest that allows High7.12026-11-10GCVE DatabaseCVE-2026-125380 DataRoom versions up to 3.0.0 have an authorization vulnerability in the DatasetController.runTest function. This flaw allows users with visitor roles to execute arbitrary dataset definitions, including specifying any dataSourceCode and raw SELECT SQL queries. As a result, attackers can query any configured relational data source using stored decrypted credentials, bypassing restrictions intended for developers only. Report on CVE-2026-125380 Vulnerability CWE-863 #ghsa-mppv-m824-3w4x	GCVE Database	2026-11-10

Page 1 of 1