Insecure direct object reference in Chat2DB (CVE-2026-63307)

Chat2DB contains an insecure direct object reference (IDOR) vulnerability (CWE-639) in the GET /api/connection/datasource/{id} endpoint. The handler calls dataSourceService.queryExistent(id, ...) without an ownership check and returns the decrypted database password field, allowing any authenticated non-admin user to enumerate datasource IDs and retrieve plaintext credentials belonging to other users. The vulnerability was live-validated against a multi-user (WEB-mode) deployment. Affected versions: - commit edf352b We recommend updating to: 5.3.0. CVSS 7.1 · our assessment: this_week Vendor advisory: https://github.com/OtterMind/Chat2DB/issues/1839 Details: https://vuln.today/cve/CVE-2026-63307