DataRoom through 3.0.0 Incorrect Authorization via /dataRoom/dataset/run/test
- Exploited
- No known exploitation
- Fix
- Fix or patch referenced
- Who is exposed
- Specific setups only
Do first: Check whether your setup matches what the bug needs. DataRoom through 3.0.0 (affected versions <= 3.0.0) At least one relational data source must be configured
- Last modified
- A 0-100 score for how much a CVE matters across the industry: exploitation, exposure, how widely the software is used, severity and whether a fix exists.What do these mean? →
- 15/100 · provisional
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Specific setups only
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
DataRoom through 3.0.0 has an incorrect authorization flaw in its dataset test endpoint that lets a low-privileged visitor-role user remotely run arbitrary SQL SELECT queries against any configured relational data source, using that source's stored credentials. Because the attacker needs to be logged in but no user interaction is required, the bug can be reached over the network with only a visitor account.
Written by anthropic/claude-haiku-5.5 from the sources below. Verify against them.
Read the original description
DataRoom through 3.0.0 contains an incorrect authorization vulnerability in DatasetController.runTest that allows visitor-role users to execute dataset definitions supplied in the request body. Attackers can specify an arbitrary dataSourceCode and raw SELECT SQL to query any configured relational data source using its stored decrypted credentials, bypassing developer-only restrictions.
cve.now Index
- Exploitation?/40Unknown. No CISA SSVC exploitation rating yet
- Exposure8/25Specific setups only, reachable over the network
- Reach?/20Unknown. No tracked technology or package matched
- Severity7.1/10CVSS 7.1
- No patch0/5No signal
What would change the score
- Would score about 65 if added to CISA KEV
- Would score about 60 if CISA's SSVC rates exploitation active
- Would score about 22 if CISA's SSVC rates it automatable
What to do
Check whether your setup matches what the bug needs.
DataRoom through 3.0.0 (affected versions <= 3.0.0) At least one relational data source must be configuredApply the patch listed under Evidence.
Timeline
- CVE published
- First seen by cve.now
Affected versions
- gcpaas DataRoom
through 3.0.0
Evidence 5
- Patch
- Report
- Repository
- Repository
- Link
Corrections
None so far.
Something wrong on this page? Report an error. Every fix is listed here.
Questions about CVE-2026-125380
Is CVE-2026-125380 being exploited?
It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.Source: cve.now feed data
What does this mean?
A user with visitor-role access can run arbitrary SELECT SQL queries against any configured relational data source, using that source's stored decrypted credentials. This lets them read data they should not be able to access.Source: vulncheck.com
Which versions are affected by CVE-2026-125380?
DataRoom: through 3.0.0.Source: cve.now feed data
Am I affected, and how do I check?
DataRoom through version 3.0.0 is affected, meaning versions up to and including 3.0.0. The issue requires at least one relational data source to be configured. To check, look at the installed DataRoom version and whether any relational data source is set up.Source: vulncheck.com
How do I fix CVE-2026-125380?
The checked facts do not name a fixed version or a workaround. Check the vendor's advisory or release notes for an upgrade target before relying on any version.Source: vulncheck.com