CVE-2026-125380— DataRoom through 3.0.0 Incorrect Authorization via /dataRoom/dataset/run/test

Quick assessment

Affected

gcpaas DataRoom

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

DataRoom 3.0.0 及更早版本在中存在授权验证缺陷，允许拥有访客（visitor）角色的用户执行请求体中提供的数据集定义。攻击者可指定任意的和原始 SQL 语句，利用已存储的解密凭据查询任何已配置的关系型数据源，从而绕过仅限开发人员访问的限制。

CVSS 6.5 · Medium Updated Nov 10, 2026

Possible ATT&CK Techniques 2 AI

T1078 · Valid Accounts T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

DataRoom through 3.0.0 Incorrect Authorization via /dataRoom/dataset/run/test

Source: CVE Program / CVE List V5

Vulnerability Description

DataRoom through 3.0.0 contains an incorrect authorization vulnerability in DatasetController.runTest that allows visitor-role users to execute dataset definitions supplied in the request body. Attackers can specify an arbitrary dataSourceCode and raw SELECT SQL to query any configured relational data source using its stored decrypted credentials, bypassing developer-only restrictions.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

授权机制不正确

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
gcpaas	DataRoom	0 ~ 3.0.0	-

II. Public POCs for CVE-2026-125380

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-125380

请登录查看更多情报信息。

Other References for CVE-2026-125380 (5)

https://github.com/gcpaas/DataRoom/commit/4022eb30d44501aa502e08696e49cbd2a3b33ae7 patch
https://github.com/gcpaas/DataRoom product
https://github.com/gcpaas/DataRoom/blob/3.0.0/dataRoomServer/src/main/java/com/gccloud/gcpaas/dataroom/core/dataset/DatasetController.java#L129-L133 technical-description
https://github.com/gcpaas/DataRoom/issues/25 issue-tracking
https://www.vulncheck.com/advisories/dataroom-through-3.0.0-incorrect-authorization-via-dataroom-dataset-run-test third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-125380

IV. Related Vulnerabilities

Same product: DataRoom

CVE-2026-125381
DataRoom through 3.0.0 SQL Injection via MyBatisService.gene

Same vendor: gcpaas

CVE-2026-125381
DataRoom through 3.0.0 SQL Injection via MyBatisService.gene

Same weakness: CWE-863