CVE-2026-108742: Dbeaver Cloudbeaver

Medium severity, CVSS 4.3. EPSS: 0.2% chance of exploitation in the next 30 days.

CloudBeaver through 25.3.5 contains a missing authorization vulnerability in the initConnection GraphQL mutation that lets view-only shared-project members persist credentials without datasource-edit permission. Attackers can set saveCredentials and sharedCredentials flags with chosen authProperties so other users connect to the shared connection under the attacker's database identity.

Affected products

• Dbeaver Cloudbeaver: up to and including 25.3.5

Published 2026-10-11. Last modified 2026-10-16.