Server-Side Export Issue in CloudBeaver Database Manager

CVE-2026-63664

What is CVE-2026-63664?

CloudBeaver, a cloud database manager, has an issue in versions 26.1.1 and earlier where certain server-side export operations fail to enforce global data export restrictions consistently. This vulnerability allows an authenticated non-administrative user, who has access to a shared database connection, to initiate server-side data exports despite administrative settings disabling such exports. This situation potentially discloses database contents that the user can query, but for which they lack permission to export. The vulnerability does not extend additional read privileges but compromises data confidentiality. It has been addressed in version 26.1.2, which ensures consistent enforcement of global export restrictions.

References