CVE-2026-108742

10th percentile - higher than 10% of all known CVEs

CloudBeaver through 25.3.5 contains a missing authorization vulnerability in the initConnection GraphQL mutation that lets view-only shared-project members persist credentials without datasource-edit permission. Attackers can set saveCredentials and sharedCredentials flags with chosen authProperties so other users connect to the shared connection under the attacker's database identity.

An attacker can capture other users' credentials or redirect their connections to an attacker-controlled database, leading to data leakage and confidentiality breaches. The risk also includes impersonation of other users in shared connection contexts.

Update CloudBeaver to a version later than 25.3.5 if available, and restrict permissions for the initConnection mutation. Audit existing shared connections for unauthorized credential changes.