Insecure Direct Object Reference in Shaiwz data-platform-open

Shaiwz data-platform-open, up to and including commit efeacd3, is susceptible to an Insecure Direct Object Reference (IDOR) vulnerability (CVE-2026-111695). The application fails to properly validate the authorization of authenticated workspace members when interacting with datasource-related API endpoints. An attacker can manipulate numeric identifiers within API requests to perform unauthorized actions on datasources belonging to other workspaces. This flaw enables attackers to exfiltrate sensitive JDBC credentials, enumerate database schemas, and perform destructive actions, such as modifying or deleting datasource configurations. This vulnerability poses a significant risk to data confidentiality and integrity within multi-tenant environments where the platform is deployed.

Impact

Successful exploitation allows authenticated attackers to gain unauthorized access to cross-tenant data. Potential damage includes the theft of sensitive JDBC connection strings and database credentials, mapping of internal database structures, and unauthorized alteration or deletion of datasource configurations. This can lead to total loss of datasource integrity and potential lateral movement into backend database infrastructure.

Recommendation

Prioritized, concrete actions for security teams:

• Apply the security patch for CVE-2026-111695 once provided by the vendor, or upgrade the application beyond commit efeacd3 immediately.
• Monitor web server access logs for anomalous patterns of sequential or high-volume requests to the endpoints /datasource/detail, /listSchemaTable, /tableDetail, /update, and /delete, particularly those associated with authenticated user sessions that deviate from normal usage patterns.
• Audit access control logs to identify users attempting to access resource IDs not assigned to their specific workspace.