Insecure Direct Object Reference in Chat2DB Affects Database Security
CVE-2026-63307

7.1HIGH

Key Information:

Vendor

Ottermind

Status
Chat2db
Vendor
CVE Published:
17 July 2026

What is CVE-2026-63307?

The Chat2DB application before version 5.3.0 has a vulnerability in its API endpoint that allows authenticated, non-admin users to access sensitive database credentials. This issue arises from an absence of proper ownership checks when querying data sources. As a result, users can enumerate datasource IDs and obtain decrypted password information belonging to other users, posing a significant risk to database security and user data integrity.

Affected Version(s)

Chat2DB 0 < 5.3.0

References

https://github.com/OtterMind/Chat2DB/issues/1839
technical-description
https://github.com/OtterMind/Chat2DB/releases/tag/v5.3.0
release-notes
https://www.vulncheck.com/advisories/forgecode-arbitrary-...
third-party-advisory

CVSS V4

Score:
7.1
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

George Chen
.