DataCap EUVD-2026-103036

Requires a valid authenticated account on the DataCap/MetaForge instance, but only low privileges (PR:L) - any ordinary user suffices; no admin role is needed. Exploitation works against default behavior with no special feature or non-default configuration required, because BaseController.getInfoForPath omits an ownership/authorization check on the numeric id. The concrete prerequisite is network access to the source, snippet and dashboard getById endpoints with the ability to iterate sequential auto-increment ids. The principal limiting factor is the authentication requirement: an unauthenticated outsider cannot reach the vulnerable endpoints, so the realistic threat model is a malicious or compromised low-privilege tenant on a multi-user deployment of DataCap through version 2025.1.1.

This is a credible mid-tier priority rather than a drop-everything emergency. The vendor-supplied CVSS 4.0 vector (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N, score 7.1) is internally consistent with the description: network-reachable (AV:N), trivially executed by enumerating sequential ids (AC:L/AT:N), but gated behind a valid low-privileged account (PR:L), with high confidentiality impact (VC:H) and no integrity or availability impact. No EPSS probability, no CISA KEV entry, and no explicit POC flag were supplied in the input, so exploitation likelihood cannot be quantified from the data provided - STATE EXPLICITLY: EPSS and KEV data are absent, not zero. No SSVC decision record was provided either. However, the referenced hackmd write-up ('metaforge-datacap-source-getbyid-cross-user-idor') is a detailed public technical analysis of the exact IDOR, which materially lowers the barrier to reproduction even though it is not confirmed packaged exploit code. The practical driver of risk is the payload: successful exploitation yields other tenants' datasource host, port, username and CLEARTEXT passwords, turning an authorization flaw into a credential-harvesting primitive that enables lateral movement into backend databases - a severity amplifier that the base CVSS confidentiality metric understates. Countervailing factors keeping this out of the top tier: authentication is genuinely required (PR:L is not PR:N), and the affected product is a niche open-source project with limited deployment, so exploitation is likely to be opportunistic/targeted against specific DataCap installs rather than internet-wide.

A low-privileged but authenticated user (or an attacker who has obtained any valid account on a DataCap/MetaForge instance) issues requests to the source, snippet and dashboard getById endpoints while incrementing the numeric id parameter. Because BaseController.getInfoForPath performs no per-object ownership check, the attacker reads other users' serialized datasource objects and recovers cleartext database credentials. A detailed public write-up of this exact IDOR is referenced, so reproduction is straightforward despite no confirmed packaged exploit.