Data Platform Open EUVD-2026-102986

The attacker must hold a valid authenticated account with membership in at least one workspace (PR:L); no administrative role and no user interaction are required. Given that access, exploitation needs only HTTP requests carrying another workspace's sequential numeric datasource id to /datasource/detail, /listSchemaTable, /tableDetail, /update, or /delete - no special feature toggle or non-default configuration is required, as the missing per-workspace authorization check is inherent to the affected commit. The practical limiting factor is the authentication requirement and the need for a reachable workspace-member session; the use of predictable sequential ids removes any need to guess object references, making enumeration trivial once authenticated.

This is a legitimate, moderately serious authorization flaw rather than an inflated high-CVSS issue, but it is not an emergency-tier vulnerability. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) confirms network-reachable, low-complexity exploitation requiring only low privileges - i.e., any authenticated workspace member, which is a meaningful but real barrier (PR:L, not PR:N). The primary impact is confidentiality (VC:H): leaked JDBC credentials for other workspaces' datasources, with secondary integrity impact (VI:L) from the /update and /delete endpoints. No EPSS score was provided in the input, and the CVE is NOT on CISA KEV, so there is no evidence of active, widespread exploitation. A detailed public technical writeup (hackmd) and the exact vulnerable source lines are referenced, which lowers the barrier to developing an exploit, but no packaged exploit code is explicitly flagged as available. The CVSS 4.0 vendor vector sets VA:N (no availability impact), yet the description explicitly states attackers can delete datasources - this is a conflict: deletion is a plausible availability/integrity impact that the vendor vector appears to understate. Net assessment: a credible priority for the small population that runs this product, driven by credential exposure that can pivot to full database compromise, but constrained by the authentication-membership requirement and the product's niche footprint.

A low-privileged member of one workspace logs into the data-platform-open application and iterates sequential numeric datasource ids against /datasource/detail and /listSchemaTable, retrieving JDBC connection strings and credentials belonging to other tenants' workspaces. Using those credentials the attacker connects directly to the backend databases, and can additionally call /update or /delete to tamper with or destroy foreign datasources. A public technical writeup exists describing the flaw and the vulnerable code paths, but no confirmed weaponized exploit tool is indicated in the input.