The vulnerability lies in DataRoom's DatasetController.runTest method, which fails to enforce proper authorization. Users with only a visitor role can supply a dataset definition containing any dataSourceCode and raw SELECT SQL, causing the server to execute the query against the configured relational data source using its stored decrypted credentials. This allows attackers to read arbitrary data that should be restricted to developers, leading to potential data exposure and confidentiality loss.

Affected systems are GCaaS DataRoom versions up to and including 3.0.0. The flaw is present in the core dataRoomServer code referenced in the source repository. No specific subversions are listed, so all deliveries of the 3.0.0 release are impacted until a patch is issued.

The CVSS score of 7.1 indicates a high severity for improper authorization. With no EPSS data and no listing in CISA KEV, exploitation potential is uncertain but the attack vector is straightforward: a web client can issue an HTTP request to /dataRoom/dataset/run/test, supply any SELECT payload, and receive the results. The vulnerability does not require elevated privileges beyond the visitor role, making it exploitable by any authenticated user with that role. Because the attacker can access decrypted credentials to the relational source, a successful exploit can lead to a significant data breach.