HIGH 7.1 NVD
CVE-2026-111614
DataCap through 2025.1.1 contains an insecure direct object reference vulnerability in BaseController.getInfoForPath that allows authenticated users to read oth
DataCap through 2025.1.1 contains an insecure direct object reference vulnerability in BaseController.getInfoForPath that allows authenticated users to read other users' datasources, snippets and dashboards by numeric id. Low-privileged attackers can enumerate auto-increment ids on the source, snippet and dashboard endpoints to retrieve serialized datasource host, port, username and cleartext passwords.
References
- https://github.com/devlive-community/MetaForge/blob/2025.1.1/core/datacap-server/src/main/
- https://github.com/devlive-community/MetaForge/blob/2025.1.1/core/datacap-service/src/main
- https://hackmd.io/@hieuPenguinnn/metaforge-datacap-source-getbyid-cross-user-idor
- https://www.vulncheck.com/advisories/datacap-through-2025.1.1-idor-via-basecontroller-geti
This high severity vulnerability with a CVSS score of 7.1 was published on 2026-10-16 via NVD.
vulnfeed aggregates 16467 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.