CVE-2026-125380

CVSS 7.1 (high) · published 2026-11-10

DataRoom through 3.0.0 contains an incorrect authorization vulnerability in DatasetController.runTest that allows visitor-role users to execute dataset definitions supplied in the request body. Attackers can specify an arbitrary dataSourceCode and raw SELECT SQL to query any configured relational data source using its stored decrypted credentials, bypassing developer-only restrictions.

Weakness: CWE-863

Source: NVD CVE-2026-125380

References

• https://github.com/gcpaas/DataRoom
• https://github.com/gcpaas/DataRoom/blob/3.0.0/dataRoomServer/src/main/java/com/gccloud/gcpaas/dataroom/core/dataset/DatasetController.java#L129-L133
• https://github.com/gcpaas/DataRoom/commit/4022eb30d44501aa502e08696e49cbd2a3b33ae7
• https://github.com/gcpaas/DataRoom/issues/25
• https://www.vulncheck.com/advisories/dataroom-through-3.0.0-incorrect-authorization-via-dataroom-dataset-run-test

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.