CVE-2026-111695
HIGH
CVSS 7.1
Published: 2026-10-16
Modified: 2026-10-16
Tenable Plugin
Checking the public Tenable catalog…
Threat Intelligence Pending
IOCs, MITRE ATT&CK techniques, and attack chain data are being generated. Refresh in a few seconds.
Description
Shaiwz data-platform-open through commit efeacd3 contains an insecure direct object reference vulnerability that allows authenticated workspace members to access other workspaces' datasources by numeric id. Attackers can send foreign sequential ids to /datasource/detail, /listSchemaTable, /tableDetail, /update or /delete to obtain JDBC credentials, enumerate database schemas, and modify or delete datasources.
Quick Facts
| CVE ID | CVE-2026-111695 |
| CVSS Score | 7.1 |
| Vector | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N |
| Published | 2026-10-16 |
| Exploited | No |
| CISA KEV | No |
| PoC | Not public |