Incorrect Authorization in DataRoom by GCPaaS allows SQL Query Execution
CVE-2026-125380

7.1HIGH

Key Information:

Vendor

Gcpaas

Status
Dataroom
Vendor
CVE Published:
9 November 2026

What is CVE-2026-125380?

DataRoom versions up to 3.0.0 are affected by an incorrect authorization flaw within the DatasetController.runTest method. This vulnerability allows users with visitor roles to manipulate dataset definitions by sending specially crafted requests. Attackers can inject an arbitrary dataSourceCode and raw SELECT SQL commands, enabling them to access any configured relational database by leveraging stored decrypted credentials and bypassing intended developer-only restrictions. This may result in unauthorized data exposure or manipulation.

Affected Version(s)

DataRoom 0 <= 3.0.0

References

https://github.com/gcpaas/DataRoom/issues/25
issue-tracking
https://github.com/gcpaas/DataRoom
product
https://github.com/gcpaas/DataRoom/blob/3.0.0/dataRoomSer...
technical-description

CVSS V4

Score:
7.1
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

hieuPenguinnn
.