CVE-2026-108745

10th percentile - higher than 10% of all known CVEs

CloudBeaver through 25.3.5 contains a missing authorization vulnerability in WebSQLResultServlet that allows any web session holder to read other users' LOB export files from a shared folder. Attackers can guess table and column names and enumerate second-resolution timestamps to download victims' LOB values, including data from connections they cannot query.

The risk includes leakage of sensitive data stored in LOB files, potentially leading to breach of customer or corporate data confidentiality. Missing authorization allows unauthorized access to other users' data.

Update CloudBeaver to a patched version and enforce proper access controls on WebSQLResultServlet. Also review permissions on shared folders and restrict access to them.