CVE-2026-42032 — CKAN: Unauthenticated Authorization Bypass in `datastore_search_sql`

CVE-2026-42032

CKAN: Unauthenticated Authorization Bypass in `datastore_search_sql` PUBLISHED

Description (CNA)

CKAN is an open-source DMS (data management system) for powering data hubs and data portals. Prior to 2.10.10 and 2.11.5, a vulnerability in datastore_search_sql allowed attackers to bypass authorization in order to gain access to private resources and PostgreSQL system information This vulnerability is fixed in 2.10.10 and 2.11.5.

Affected (CNA)

Vendor / product	Versions
ckan / ckan	affected >= 2.11.0, < 2.11.5; affected < 2.10.10

CWE

CWE-863

References

https://github.com/ckan/ckan/security/advisories/GHSA-cg4x-64p3-x59h

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.