Threat database

CloudBeaver versions up to 25.3.5 have a missing authorization vulnerability in the WebSQLResultServlet component. This flaw allows any authenticated web session user to access and download other users' LOB export files stored in a shared folder. Attackers can enumerate table and column names and guess timestamps to retrieve large object data from database connections they are not authorized to query. The vulnerability has a low CVSS score of 2.3 and does not appear to be actively exploited in the wild.

CloudBeaver versions up to 25.3.5 contain a missing authorization vulnerability in the initConnection GraphQL mutation. This flaw allows view-only shared-project members to persist credentials without having datasource-edit permissions. Attackers can manipulate flags to have other users connect to the shared connection using the attacker's database identity.