CVE-2026-111614

EUVD-2026-103036
DataCap through 2025.1.1 contains an insecure direct object reference vulnerability in BaseController.getInfoForPath that allows authenticated users to read other users' datasources, snippets and dashboards by numeric id. Low-privileged attackers can enumerate auto-increment ids on the source, snippet and dashboard endpoints to retrieve serialized datasource host, port, username and cleartext passwords.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
6.5 MEDIUM
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: 21.93%
Common Weakness Enumeration
References
https://github.com/devlive-community/MetaForge/blob/2025.1.1/core/datacap-server/src/main/java/io/edurt/datacap/server/controller/BaseController.java#L91-L95
https://github.com/devlive-community/MetaForge/blob/2025.1.1/core/datacap-service/src/main/java/io/edurt/datacap/service/service/BaseService.java#L38-L43
https://hackmd.io/@hieuPenguinnn/metaforge-datacap-source-getbyid-cross-user-idor
https://www.vulncheck.com/advisories/datacap-through-2025.1.1-idor-via-basecontroller-getinfoforpath-exposes-credentials
https://hackmd.io/@hieuPenguinnn/metaforge-datacap-source-getbyid-cross-user-idor