CVE-2026-111695 is a high severity (CVSS 7.1) insecure direct object reference in data-platform-open through commit efeacd3. Authenticated workspace members can read and change other workspaces' datasources by numeric ID, including JDBC credentials. The record names no fixed version. The sections below cover affected versions, how to check, and what to do first.
What's affected
Shaiwz data-platform-open through commit efeacd3, per the record and VulnCheck. The project is referenced by commit, so there is no release number to compare. I could not confirm a fixed release from the pages I fetched, so check the project's releases and issue tracker before you rely on one.
The record lists the affected routes: detail, schema and table listing, table detail, update and delete for datasources. Sequential numeric IDs make guessing easy.
Scoring note: the record's 7.1 is a CVSS 3.1 base score. VulnCheck's advisory also lists 7.1 under CVSS 4.0. Both describe the same flaw, and the two versions weigh the factors differently.
How to check if you're exposed
Find out which commit you deployed, for example by checking the git history of your build. If your commit is efeacd3 or earlier, treat it as affected.
Then audit datasource records. Look for datasources whose connection details changed or that disappeared, and check your databases' own logs for logins from the platform host that you do not recognise.
What to do now
- Identify which commit each deployment was built from.
- Restrict workspace membership to trusted users.
- Rotate database credentials stored as datasources, because they may have been read.
- Review datasource updates and deletions for cross workspace activity.
- Check the repository for a commit that adds ownership checks, then rebuild and redeploy from it.
- Scan your dependencies with the free in-browser scan and look the CVE up in the Gold directory to see where else it appears.
Do not stop at one host. Write down every place the affected software runs, including test servers, forgotten containers and copies bundled inside other products. Then rank them by exposure: anything reachable from the internet comes first, internal systems next. A short inventory now saves hours when the next advisory lands.
Why it matters
This is CWE-639, authorization bypass through a user-controlled key, often called an IDOR. The server fetches a datasource by its numeric ID without checking that it belongs to the caller's workspace.
The impact is amplified because datasources hold live database credentials. Reading one is a step toward the database behind it. Sequential IDs let a user enumerate every workspace without any guessing skill. It is not listed in CISA KEV.
Quick check
What is an IDOR?
A flaw where changing an identifier in a request reaches an object that belongs to someone else.
Why rotate credentials?
The record says attackers can obtain JDBC credentials, so any stored credential may have been read.
Sources
Last reviewed: 18 October 2026.
