CVE-2026-110975 Autotune: kruize/autotune: kruize/autotune: datasources credential disclosure

A flaw was found in Kruize Autotune. Its REST API ships without an authentication layer, and the endpoints that return datasource configuration — the list-datasources endpoint GET /datasources and the datasource-metadata endpoint — serialized datasource objects using a default Gson configuration...

CVE-2026-110975

A flaw in Kruize Autotune allows for datasources credential disclosure due to a lack of an authentication layer on its REST API. Specifically, the list-datasources (GET /datasources) and datasource-metadata endpoints serialize datasource objects using a default Gson configuration without a field-...

CVE-2026-110975 Autotune: kruize/autotune: kruize/autotune: datasources credential disclosure

A flaw was found in Kruize Autotune. Its REST API ships without an authentication layer, and the endpoints that return datasource configuration — the list-datasources endpoint GET /datasources and the datasource-metadata endpoint — serialized datasource objects using a default Gson configuration...

CVE-2026-110975 Autotune: kruize/autotune: kruize/autotune: datasources credential disclosure

A flaw was found in Kruize Autotune. Its REST API ships without an authentication layer, and the endpoints that return datasource configuration — the list-datasources endpoint GET /datasources and the datasource-metadata endpoint — serialized datasource objects using a default Gson configuration...

CVE-2026-111695

Shaiwz data-platform-open through commit efeacd3 contains an insecure direct object reference vulnerability that allows authenticated workspace members to access other workspaces' datasources by numeric id. Attackers can send foreign sequential ids to /datasource/detail, /listSchemaTable,...

CVE-2026-111614

DataCap through 2025.1.1 contains an insecure direct object reference vulnerability in BaseController.getInfoForPath that allows authenticated users to read other users' datasources, snippets and dashboards by numeric id. Low-privileged attackers can enumerate auto-increment ids on the source,...

EUVD-2026-102986

Shaiwz data-platform-open through commit efeacd3 contains an insecure direct object reference vulnerability that allows authenticated workspace members to access other workspaces' datasources by numeric id. Attackers can send foreign sequential ids to /datasource/detail, /listSchemaTable,...

EUVD-2026-103036

DataCap through 2025.1.1 contains an insecure direct object reference vulnerability in BaseController.getInfoForPath that allows authenticated users to read other users' datasources, snippets and dashboards by numeric id. Low-privileged attackers can enumerate auto-increment ids on the source,...

CVE-2026-111614 DataCap through 2025.1.1 IDOR via BaseController.getInfoForPath Exposes Credentials

DataCap through 2025.1.1 contains an insecure direct object reference vulnerability in BaseController.getInfoForPath that allows authenticated users to read other users' datasources, snippets and dashboards by numeric id. Low-privileged attackers can enumerate auto-increment ids on the source,...

PT-2026-116094

Shaiwz data-platform-open through commit efeacd3 contains an insecure direct object reference vulnerability that allows authenticated workspace members to access other workspaces' datasources by numeric id. Attackers can send foreign sequential ids to /datasource/detail, /listSchemaTable,...

PT-2026-116013

🚨 CVE-2026-111614 DataCap through 2025.1.1 contains an insecure direct object reference vulnerability in BaseController.getInfoForPath that allows authenticated users to read other users' datasources, snippets and dashboards by numeric id. Low-privileged attackers can enumerate auto-increment ids...

CVE-2026-66083

The /datasources/unauth-datasource endpoint does not properly enforce data source authorization. An authenticated user can invoke this endpoint to obtain information about data sources they are not authorized to access. This may expose data source configuration and other sensitive metadata,...

CVE-2026-66083 Apache DolphinScheduler: Unauthorized Disclosure of Data Source Information via /datasources/unauth-datasource

The /datasources/unauth-datasource endpoint does not properly enforce data source authorization. An authenticated user can invoke this endpoint to obtain information about data sources they are not authorized to access. This may expose data source configuration and other sensitive metadata,...

CVE-2026-66083

The Apache DolphinScheduler software (versions prior to 3.4.3 ) is vulnerable to an authorization flaw in the /datasources/unauth-datasource endpoint. An authenticated user can exploit this to access information regarding data sources they are not authorized to view. This could result in the expo...

EUVD-2026-88742

The /datasources/unauth-datasource endpoint does not properly enforce data source authorization. An authenticated user can invoke this endpoint to obtain information about data sources they are not authorized to access. This may expose data source configuration and other sensitive metadata,...

CVE-2026-66083 Apache DolphinScheduler: Unauthorized Disclosure of Data Source Information via /datasources/unauth-datasource

The /datasources/unauth-datasource endpoint does not properly enforce data source authorization. An authenticated user can invoke this endpoint to obtain information about data sources they are not authorized to access. This may expose data source configuration and other sensitive metadata,...

CVE-2026-66083 Apache DolphinScheduler: Unauthorized Disclosure of Data Source Information via /datasources/unauth-datasource

The /datasources/unauth-datasource endpoint does not properly enforce data source authorization. An authenticated user can invoke this endpoint to obtain information about data sources they are not authorized to access. This may expose data source configuration and other sensitive metadata,...

PT-2026-102508

The /datasources/unauth-datasource endpoint does not properly enforce data source authorization. An authenticated user can invoke this endpoint to obtain information about data sources they are not authorized to access. This may expose data source configuration and other sensitive metadata,...

CVE-2026-63458: Authorization Bypass Through User-Controlled Key

Perses is an open-source dashboard and visualization project for observability data. Prior to 0.54.0-beta.3, an authenticated user with viewer access to one project can supply another project through the project query parameter on project-scoped list endpoints, including...

CVE-2026-63199: Missing Authorization

Perses is an open-source dashboard and visualization project for observability data. From 0.43.0 until 0.54.0-rc.0, the datasource creation and unsaved datasource proxy paths authorize the caller on a Datasource or GlobalDatasource scope but do not require read permission for the separately...