CyberRota Analysis
AI-GeneratedA missing authorization vulnerability in CloudBeaver allows any authenticated user to access and download other users' large object (LOB) export files from shared folders. This could lead to unauthorized data exposure, as attackers can infer table and column names to retrieve sensitive information they should not have access to. Organizations using CloudBeaver should prioritize addressing this issue to protect user data from potential exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
CloudBeaver through 25.3.5 contains a missing authorization vulnerability in WebSQLResultServlet that allows any web session holder to read other users' LOB export files from a shared folder. Attackers can guess table and column names and enumerate second-resolution timestamps to download victims' LOB values, including data from connections they cannot query.