# CVE-2026-63664: CloudBeaver: Authorization Bypass (BFLA) - Data Export Restriction Bypass

Status: published. Published: 2026-11-06. Updated: 2026-11-06.

CloudBeaver is a cloud database manager. In versions up to and including 26.1.1, some server-side export operations do not consistently enforce the global data export restriction. An authenticated non-administrative user with access to a shared database connection can initiate certain server-side data exports even when an administrator has disabled exports. This can disclose database contents that the user is permitted to query but is not permitted to export. The issue does not grant additional database read privileges. It is fixed in 26.1.2 by consistently enforcing the global restriction for server-side exports.

## Remediation

No remediation reported in collected sources

## Affected products and versions

- dbeaver / cloudbeaver: < 26.1.2 (affected). Source: CNA: GitHub_M

## Severity and prioritization

- CVSS 3.1: 6.5 (medium); CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N; source: CNA: GitHub_M

- CISA KEV: No listing in collected sources

- EPSS: Not available

- SSVC: Not available

- Weaknesses: CWE-862

## Exploit evidence

No exploit evidence in collected sources. This is not proof of no exploitation.

## References

- https://github.com/dbeaver/cloudbeaver/security/advisories/GHSA-9vv7-rf3x-8xr8 (CNA: GitHub_M; x_refsource_CONFIRM)

- https://github.com/dbeaver/cloudbeaver/pull/4394 (CNA: GitHub_M; x_refsource_MISC)

- https://github.com/dbeaver/cloudbeaver/commit/58f51ee5f6fc1e93b14f4d96c1f75fbcc13407e9 (CNA: GitHub_M; x_refsource_MISC)

## Provenance

- CNA: GitHub_M: https://www.cve.org/CVERecord?id=CVE-2026-63664; retrieved 2026-11-06; source updated 2026-11-06

Revision: 651b76783adc7307db79fb080885bae45eb4621c79a26dbe772253eef91cc884

Canonical: https://y2.dev/cve/CVE-2026-63664

## Agent and API access

Public CVE pages, Markdown, and JSON are free to read without an account or API key.

- Public catalog: https://y2.dev/cve/index.json. Follow nextCursor with the same search, filters, sort, and limit (1–100). A null cursor marks the end.

- WebMCP: search_cve_disclosures, get_cve_disclosure, get_cve_page_markdown, get_y2_cve_access. Available in compatible browsers.

- Cyber API: https://api.y2.dev/api/v2/cyber/cves and https://api.y2.dev/api/v2/cyber/cves/{cveId}.

- Y2 Pro or Elite: create a workspace API key with the intel:cyber scope and send Authorization: Bearer <Y2_API_KEY>. Setup: https://y2.dev/docs/api/create-key.

- x402: Pay per request without an account or API key. Omit Authorization, read the HTTP 402 PAYMENT-REQUIRED challenge, validate its current requirements, and retry with PAYMENT-SIGNATURE through an authorized payment client. These browser tools never make payments. Guide: https://y2.dev/docs/api/x402.

- OpenAPI: https://y2.dev/api/openapi.yaml. Agent access metadata: https://y2.dev/cve/agent.json.

Collected public records only. Check source status for coverage and freshness.