Vulnerability · Published Jul 17, 2026 · Assigned by VulnCheck

CVE-2026-63307Chat2DB < 5.3.0 Insecure Direct Object Reference via GET /api/connection/datasource

Medium 6.5

In plain English

A medium-severity authorization bypass via user-controlled key in Chat2DB from OtterMind. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 35% of all known vulnerabilities).

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.4%top 65.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Chat2DB before 5.3.0 contains an insecure direct object reference vulnerability in the GET /api/connection/datasource/{id} endpoint. The handler calls dataSourceService.queryExistent(id, ...) without an ownership check and returns the decrypted password field, allowing any authenticated non-admin user to enumerate datasource IDs and read the plaintext database credentials of datasources owned by other users.

Affected products (as reported)

Vendor	Product	Versions
OtterMind	Chat2DB	0 – before 5.3.0

Weakness: CWE-639 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

References

Researcher Disclosure technical-description
Release Notes release-notes
https://www.vulncheck.com/advisories/forgecode-arbitrary-code-execution-via-unvetted-mcp-json-in-untrusted-repository third-party-advisory