CVE-2026-111695 shaiwz CVE debrief

Who should care

Defenders responsible for Shaiwz data-platform-open deployments, security teams, and vulnerability management teams should assess exposure and prioritize verification of datasource services. They should ensure proper authorization mechanisms are in place and monitor for suspicious activity. Additionally, operators and administrators of affected systems should be aware of the potential risks and take necessary precautions to prevent exploitation.

Why it matters

CVE-2026-111695 is a high-severity vulnerability in Shaiwz data-platform-open that allows authenticated workspace members to access other workspaces' datasources. Defenders should prioritize verifying exposure of datasource services and ensuring proper authorization mechanisms are in place.

• Obtain JDBC credentials for unauthorized datasources
• Enumerate database schemas for unauthorized datasources
• Modify or delete datasources without authorization

Technical summary

The vulnerability allows authenticated workspace members to access other workspaces' datasources by numeric id in Shaiwz data-platform-open through commit efeacd3. Attackers can send foreign sequential ids to /datasource/detail, /listSchemaTable, /tableDetail, /update or /delete to obtain JDBC credentials, enumerate database schemas, and modify or delete datasources. This could lead to unauthorized data access and manipulation. Defenders should prioritize verifying exposure of datasource services and ensuring proper authorization mechanisms are in place.

Defensive priority

Defenders should prioritize verifying exposure of datasource services, checking for unauthorized access, and ensuring proper authorization mechanisms are in place.

Recommended defensive actions

• Verify exposure of datasource services
• Check for unauthorized access
• Ensure proper authorization mechanisms are in place
• Monitor for suspicious activity
• Review compensating controls for exposed systems
• Track exceptions and retest remediated assets
• Confirm whether affected product deployments exist in managed environments

Evidence notes

The vulnerability was reported by an external source and is documented in the CVE Program record and NVD vulnerability detail page. The external source provided limited information about the vulnerability, which affects Shaiwz data-platform-open through commit efeacd3. Defenders should verify the exposure of datasource services and ensure proper authorization mechanisms are in place. The vulnerability allows authenticated workspace members to access other workspaces' datasources by numeric id, potentially leading to unauthorized data

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.