An insecure direct object reference in the Shaiwz data-platform-open APIs allows any authenticated member of a workspace to read, list, update, or delete datasources belonging to other workspaces. By sending crafted numeric identifiers to the /datasource/detail, /listSchemaTable, /tableDetail, /update, or /delete endpoints, a malicious actor can retrieve JDBC credentials, enumerate the database schema, and manipulate or remove data sources. This capability compromises the confidentiality, integrity, and availability of the data managed by other workspace users.

The vulnerability affects the Shaiwz data-platform-open platform. All deployments running the code prior to the commit identified as efeacd3 lack the necessary access control checks, irrespective of the specific version number. Administrators should verify whether their instance includes this commit or earlier. No version range is currently listed.

The CVSS score of 7.1 indicates a moderate to high severity level. No EPSS value is published, so the probability of exploitation cannot be quantified precisely, but the lack of a KEV listing does not preclude exploitation. An attacker only needs to be an authenticated workspace member and to know or guess numeric datasource identifiers; the vulnerability is exploitable via standard HTTP requests to the exposed REST endpoints. The former side‑channel is sufficient for destructive operations such as credential theft or data source deletion.