Ververica Platform Broken Access Control Vulnerability in SQL Connectors

A broken access control vulnerability has been identified in Ververica Platform version 2.14.0. This vulnerability allows low-privileged users to access SQL connectors by sending a direct request to the namespaces/default/formats endpoint. Normally, this feature is hidden from users with lower privileges.

Impact

Exploitation of this vulnerability allows low-privileged users to access administrative functions related to SQL connectors, which could lead to unauthorized data manipulation or access.

Reproduction

To reproduce this vulnerability, a low-privileged user can send a request to the namespaces/default/formats endpoint. This request will bypass the access controls and grant access to the SQL connectors feature, which is typically restricted.