CVE-2026-108745 DBeaver CVE debrief

Who should care

Defenders responsible for CloudBeaver deployments, especially those with shared folders and LOB export features, should assess exposure and prioritize verification and remediation efforts.

Why it matters

CVE-2026-108745 is a missing authorization vulnerability in CloudBeaver through 25.3.5 that allows unauthorized access to LOB export files. Defenders should prioritize verifying exposure, assessing inventory, and implementing compensating controls.

• Defenders need to verify exposure in CloudBeaver deployments.
• Affected versions require patching or compensating controls.
• Monitoring for suspicious access to LOB export files is necessary.
• Remediation priority is low due to CVSS score of 2.3.

Technical summary

CloudBeaver through 25.3.5 contains a missing authorization vulnerability in WebSQLResultServlet that allows any web session holder to read other users' LOB export files from a shared folder. Attackers can guess table and column names and enumerate second-resolution timestamps to download victims' LOB values, including data from connections they cannot query. The vulnerability allows unauthorized access to LOB export files. Defenders should prioritize verifying exposure in CloudBeaver deployments, especially those with shared folders and LOB export features. They should assess their inventory for affected versions and consider compensating controls, such as monitoring for suspicious access to LOB export files.

Defensive priority

Defenders should prioritize verifying exposure in CloudBeaver deployments, especially those with shared folders and LOB export features. They should assess their inventory for affected versions and consider compensating controls, such as monitoring for suspicious access to LOB export files.

Recommended defensive actions

• Verify CloudBeaver deployments for exposure, especially those with shared folders and LOB export features.
• Assess inventory for affected versions (0 to 25.3.5).
• Consider compensating controls, such as monitoring for suspicious access to LOB export files.
• Implement additional authorization checks for WebSQLResultServlet.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record and source item provide details about the missing authorization vulnerability in CloudBeaver through 25.3.5. The vulnerability allows any web session holder to read other users' LOB export files from a shared folder. However, the corpus does not provide information on exploitation or specific victims.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.