CVE-2026-63307: Chat2DB Information Disclosure Flaw

CVE-2026-63307 Overview

CVE-2026-63307 is an insecure direct object reference (IDOR) vulnerability in Chat2DB versions prior to 5.3.0. The flaw resides in the GET /api/connection/datasource/{id} endpoint, where the handler invokes dataSourceService.queryExistent(id, ...) without performing an ownership check. The response includes the decrypted password field, enabling any authenticated non-admin user to enumerate datasource IDs and read plaintext database credentials owned by other users. The issue is tracked under CWE-639 (Authorization Bypass Through User-Controlled Key).

Critical Impact
Authenticated low-privilege users can retrieve plaintext credentials for every stored datasource, resulting in cross-tenant database credential disclosure.

Affected Products

Chat2DB versions prior to 5.3.0
Chat2DB self-hosted deployments exposing the datasource connection API
Multi-user Chat2DB instances with non-admin accounts

Discovery Timeline

2026-07-17 - CVE-2026-63307 published to NVD
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-63307

Vulnerability Analysis

Chat2DB stores database connection profiles (datasources) per user, each containing credentials required to authenticate to backend databases. The application encrypts stored passwords at rest, but the GET /api/connection/datasource/{id} endpoint decrypts and returns the password in the response body. The controller passes the caller-supplied id directly to dataSourceService.queryExistent(id, ...) without validating that the requesting user owns the datasource.

This design flaw converts a routine lookup into a credential disclosure primitive. Any authenticated user can iterate the integer id space and harvest credentials belonging to other tenants. The vulnerability requires only a valid non-admin session and network access to the API.

Root Cause

The root cause is missing object-level authorization on the datasource retrieval handler. The service layer method queryExistent performs an existence lookup but does not filter by owner identity. Sensitive fields such as password are serialized into the response after decryption, so the absence of an ownership predicate directly exposes cleartext secrets.

Attack Vector

An attacker authenticates to Chat2DB with any valid low-privilege account. The attacker then issues sequential GET requests against /api/connection/datasource/{id} for candidate integer IDs. Each successful response returns the target datasource metadata along with the decrypted password. The harvested credentials can be reused to connect directly to the backing MySQL, PostgreSQL, or other databases, bypassing Chat2DB entirely.

No exploitation code is required beyond a standard HTTP client. See GitHub Issue #1839 for the upstream report and additional technical detail.

Detection Methods for CVE-2026-63307

Indicators of Compromise

Sequential or enumerated GET /api/connection/datasource/{id} requests from a single authenticated session
API responses containing populated password fields returned to non-owner accounts
Unexpected outbound database connections originating from IP addresses associated with Chat2DB users
Access log entries showing a single user retrieving datasource IDs across many owner accounts

Detection Strategies

Parse Chat2DB application logs for GET /api/connection/datasource/ requests and correlate the {id} value against the authenticated user's owned datasources.
Alert on any session that requests more than a small threshold of distinct datasource IDs within a short interval.
Monitor database authentication logs for successful logins from user contexts that do not match the datasource owner's expected activity pattern.

Monitoring Recommendations

Enable verbose HTTP access logging on the Chat2DB reverse proxy and ship logs to a centralized SIEM.
Baseline normal per-user datasource access patterns and generate alerts on statistical deviations.
Review Chat2DB audit logs weekly for enumeration behavior against the /api/connection/datasource/ route.

How to Mitigate CVE-2026-63307

Immediate Actions Required

Upgrade Chat2DB to version 5.3.0 or later as published in the GitHub Release v5.3.0.
Rotate every database credential stored in Chat2DB, since any credential accessible to a non-admin account may have been disclosed.
Audit application logs for prior enumeration of the /api/connection/datasource/{id} endpoint.
Restrict Chat2DB network exposure to trusted internal networks until patching is complete.

Patch Information

The vendor released the fix in Chat2DB v5.3.0. The patch introduces an ownership check in the datasource retrieval flow so that queryExistent returns data only when the requesting user owns the datasource. Refer to the GitHub Release v5.3.0 notes for the exact commit set.

Workarounds

Limit Chat2DB to single-tenant use, ensuring only administrators hold accounts until the patch is applied.
Place the API behind a reverse proxy that denies GET /api/connection/datasource/{id} for non-admin sessions.
Rotate stored database credentials on a short cadence and use least-privilege database accounts to reduce blast radius.

bash

# Example nginx block to restrict the vulnerable endpoint until patched
location ~ ^/api/connection/datasource/[0-9]+$ {
    if ($request_method = GET) {
        return 403;
    }
    proxy_pass http://chat2db_backend;
}