The vulnerability is an insecure direct object reference in the GET /api/connection/datasource/{id} endpoint of Chat2DB. The handler calls dataSourceService.queryExistent(id, …) without performing an ownership check and returns a decrypted password field. Consequently, any authenticated user who is not an administrator can enumerate datasource IDs and read the plaintext credentials of datasource records owned by other users. The weakness is identified as CWE-639, a type of unauthorized disclosure caused by insufficient access control over direct resource references.

All versions of OtterMind Chat2DB earlier than 5.3.0 are affected. The flaw applies to deployments where users have authenticated accounts that do not hold administrative privileges. The issue resides solely within the application layer and does not depend on the underlying database or infrastructure.

The CVSS score of 7.1 signals a medium‑to‑high risk. The EPSS score of less than 1% indicates that, as of now, exploitation is unlikely, and the vulnerability is not listed in the CISA KEV catalog. Nonetheless, because the attack requires only legitimate, authenticated use of a standard API endpoint, attackers can enumerate datasource identifiers and harvest sensitive credentials, potentially compromising downstream database systems and enabling further attacks in multi‑tenant or shared environments.