CVE-2026-108745: Dbeaver Cloudbeaver

Low severity, CVSS 3.1. EPSS: 0.2% chance of exploitation in the next 30 days.

CloudBeaver through 25.3.5 contains a missing authorization vulnerability in WebSQLResultServlet that allows any web session holder to read other users' LOB export files from a shared folder. Attackers can guess table and column names and enumerate second-resolution timestamps to download victims' LOB values, including data from connections they cannot query.

Affected products

• Dbeaver Cloudbeaver: up to and including 25.3.5

Published 2026-10-11. Last modified 2026-10-16.