Executive brief
Chat2DB, a database management and SQL client tool, contains a security flaw in its multi-user web mode. An authenticated user can exploit this vulnerability to view the plaintext database passwords of any other user on the system. This could lead to unauthorized access to sensitive corporate databases and potential data theft or manipulation.
Technical details
An Insecure Direct Object Reference (IDOR) vulnerability exists in the GET /api/connection/datasource/{id} endpoint of Chat2DB. The application fails to perform an ownership check when a user requests details for a specific datasource ID, calling dataSourceService.queryExistent(id) without verifying if the requesting user owns the resource. Because the response includes the decrypted password field, any authenticated non-admin user can enumerate datasource IDs to extract plaintext credentials for databases configured by other users. This issue is resolved in version 5.3.0.
Affected products
- OtterMind Chat2DB before 5.3.0
Timeline
- 2026-05-27: other: Vulnerability reported to vendor via email
- 2026-07-01: disclosed: Public issue tracker entry created
- 2026-07-17: patched: Version 5.3.0 released
- 2026-07-17: advisory: CVE-2026-63307 published