The vulnerability is an insecure direct object reference in BaseController.getInfoForPath, enabling authenticated users to read other users’ datasources, snippets, and dashboards by numeric id. Low‑privileged attackers can enumerate auto‑increment identifiers on those endpoints and retrieve serialized datasource host, port, username, and clear‑text passwords. This directly exposes credential material and sensitive configuration details, compromising confidentiality.

The flaw affects the DataCap platform from devlive‑community up through version 2025.1.1. All releases before and including that version are vulnerable. It applies to the server and service modules that expose the BaseController and BaseService routes used for datasource, snippet and dashboard management.

The CVSS score of 7.1 indicates a high level of risk. Because the flaw requires only authentication, the attack vector is likely remote over HTTP and requires enumeration of sequential IDs, which can be automated. The EPSS score is not available, but the lack of a KEV listing suggests no known large‑scale exploits yet. Nonetheless, the ability to read credentials and configuration data makes it a significant confidentiality threat worth addressing without delay.