CVE-2026-111695

HighCVSS 7.1/10Last modified Oct 19, 2026

Description

Shaiwz data-platform-open through commit efeacd3 contains an insecure direct object reference vulnerability that allows authenticated workspace members to access other workspaces' datasources by numeric id. Attackers can send foreign sequential ids to /datasource/detail, /listSchemaTable, /tableDetail, /update or /delete to obtain JDBC credentials, enumerate database schemas, and modify or delete datasources.

Metrics

CVSS 3.1 7.1/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

Weakness enumeration

CWE-639

Affected software

No affected versions have been published.

Timeline

Published: Oct 16, 2026
Last modified: Oct 19, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-1116966.5data-platform-open through commit efeacd3 uses a hardcoded, publicly known default AES key in AesPasswordEncAndDecServiceImpl, allowing auth CVE-2026-1116976.5HUIZHI ChargeOS cloud through 3.0.9 contains an insecure direct object reference vulnerability in the hcp-mp MeController and OrderControlle CVE-2026-1116986.5HUIZHI ChargeOS cloud through 3.0.9 contains a missing authorization vulnerability in the hcp-mp PayController.xcxRecharge endpoint that all CVE-2026-1116994.8Niefy wx-api through 0.8.2 contains an authentication bypass vulnerability that allows unauthenticated attackers to impersonate WeChat fans CVE-2026-11178.2A vulnerability in the `lollms_generation_events.py` component of parisneo/lollms version 5.9.0 allows unauthenticated access to sensitive S CVE-2026-111708.1Inappropriate implementation in Chromoting in Google Chrome on Linux prior to 149.0.7827.53 allowed a remote attacker to perform OS-level pr CVE-2026-1117007.1WebVella ERP through 1.8.8 contains an sql injection vulnerability that allows any authenticated user to inject SQL through WHERE-clause tex CVE-2026-1117017.0OtterMind Nubase through 0.1.4 contains a missing authentication vulnerability that allows unauthenticated attackers to access private bucke CVE-2026-1117027.5ChatOllama through commit 96c3ce5 contains an insecure direct object reference vulnerability that allows remote attackers to access other us CVE-2026-1117036.3yshop-crm through 2.1.3 contains an insecure direct object reference vulnerability that allows authenticated sales users to access other use CVE-2026-1117049.8LangChat through commit 2a6285a contains a missing authentication vulnerability that allows unauthenticated remote attackers to access REST CVE-2026-1117054.3Fuint through commit 57ec018 contains an insecure direct object reference vulnerability that allows authenticated members to read other memb