CloudBeaver EUVD-2026-96908

Exploitation requires an authenticated CloudBeaver account that is a member - even view-only - of a shared project, and a multi-user deployment using the shared-projects/team collaboration feature (not a single-user install). The attacker abuses the initConnection GraphQL mutation to set saveCredentials and sharedCredentials with chosen authProperties despite lacking datasource-edit permission. Limiting factors: valid low-privilege authentication is mandatory (not anonymous/remote-unauthenticated), the shared-connection collaboration feature must be in use, and meaningful impact only materializes when other users subsequently connect to the attacker-tampered shared connection. No special client-side user interaction is required for the attacker's action.

This is a genuine but moderate-severity authorization flaw, not a drop-everything priority. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) scores 5.3 and correctly reflects a network-reachable, low-complexity attack that nonetheless REQUIRES authentication (PR:L) - the attacker must already be a valid view-only member of a shared project. Impact is limited to integrity (VI:L) with no confidentiality or availability impact, consistent with the CWE-862 missing-authorization root cause: the flaw lets a low-privilege user persist connection credentials they should not control, causing other users to connect under the attacker's database identity. No EPSS score, CISA KEV listing, or SSVC decision data was provided, so automatability and exploitation-maturity cannot be assessed from the input. No public exploit was flagged in the input, though a detailed third-party technical write-up (hackmd) and the exact vulnerable source lines on GitHub are referenced, which lowers the barrier to developing an exploit. Overall: a legitimate authorization-boundary bug meaningful to multi-user CloudBeaver deployments, but the authentication prerequisite and integrity-only impact keep real-world risk in the medium band rather than critical.

An attacker holds a view-only membership in a shared CloudBeaver project. Via the initConnection GraphQL mutation they set the saveCredentials and sharedCredentials flags with their own authProperties - an action that should require datasource-edit permission - so the shared connection persists the attacker's database credentials. Other project members then unknowingly connect to the datasource under the attacker's database identity. No public proof-of-concept exploit was indicated in the input, but a detailed technical write-up and the affected source lines are publicly referenced.