CloudBeaver is a cloud database manager that permits authenticated users to manage databases. In versions up to and including 26.1.1, the server‑side export functionality fails to apply the global data export restriction consistently. An authenticated non‑administrative user who has access to a shared database connection can trigger certain data export operations even when an administrator has disabled exports. This allows the user to retrieve data that they can query but are not permitted to export, leading to a confidentiality breach. The vulnerability does not grant additional read or write privileges on the database beyond those normally available.

CloudBeaver version 26.1.1 and earlier, supplied by the dbeaver:cloudbeaver project.

The CVSS score is 6.5, indicating moderate severity. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog. The attack is likely confined to authenticated non‑admin users with shared database connections. Because the flaw is limited to export operations, an attacker cannot elevate database privileges, but the ability to download data bypasses the administrator‑controlled restriction, potentially exposing sensitive information. The overall risk remains moderate, but administrators should prioritize remediation.