Insecure Direct Object Reference in DataCap by Devlive Community

CVE-2026-111614

What is CVE-2026-111614?

DataCap versions up to 2025.1.1 are susceptible to an insecure direct object reference vulnerability found in the BaseController.getInfoForPath method. This flaw allows authenticated users to access sensitive resources belonging to other users by exploiting predictable numeric IDs. Low-privileged attackers can enumerate IDs from the source, snippet, and dashboard endpoints, thereby retrieving sensitive information including serialized datasource host details, port numbers, usernames, and cleartext passwords. This vulnerability poses a significant risk to data privacy and application security.

References