Insecure Direct Object Reference in Shaiwz Data-Platform-Open

CVE-2026-111695

What is CVE-2026-111695?

The Shaiwz Data-Platform-Open exposes a vulnerability whereby authenticated users can exploit insecure direct object references, allowing them to access the datasources of other workspaces. By sending sequential numeric IDs through various API endpoints such as /datasource/detail and /update, users can retrieve sensitive JDBC credentials as well as enumerate database schemas. This could lead to unauthorized modifications or deletions of datasources, posing significant risks to data confidentiality and integrity.

References