Executive brief
Data Space Portal is an open-source platform used to manage and streamline data sharing environments (dataspaces). A security flaw allows users who have registered but not yet been approved to bypass the "pending" status and access restricted features. An unapproved attacker could view private data catalogs, register their own connectors to participate in the dataspace, and potentially flood the network with malicious data offers, undermining the trust and operational integrity of the entire dataspace.
Technical details
The dataspace-portal backend fails to verify the account status (ACTIVE vs. PENDING) for several critical API endpoints. While the frontend correctly displays a 'pending approval' message to new self-registered users, the backend only checks for basic roles and organization membership without validating if the organization or user has been approved by an administrator. An attacker can register an account and then directly call REST API endpoints (such as catalog access and connector registration) using their session cookie. This allows unauthorized participants to join the dataspace, view sensitive catalogs, and register connectors in Keycloak/DAPS. The vulnerability is rooted in a reliance on client-side enforcement for what should be server-side security logic. This issue is resolved in version 7.3.2.
Affected products
- sovity Data Space Portal 2.1.1 to before 7.3.2
Timeline
- 2026-04-20: patched: Version 7.3.2 released
- 2026-04-20: advisory: GitHub Security Advisory published
- 2026-05-08: disclosed: CVE published to NVD