PT-2026-53659 · Gorse Io · Gorse

George Chen · Publicado 2026-06-29 · Atualizado 2026-06-29 · CVE-2026-56782

NVD

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Gorse before 0.5.10 contains an authentication bypass vulnerability in the /api/dump and /api/restore endpoints that allows unauthenticated attackers to access protected functionality when admin api key is empty, which is the default configuration. Remote attackers can exfiltrate the entire database including user records, items, and feedback data containing personally identifiable information, or completely overwrite the dataset without authentication.

Correção

Missing Authentication

Enumeração de Fraquezas

CWE-306

Identificadores relacionados

CVE-2026-56782

Produtos afetados

Gorse

Referências · 5

• https://github.com/gorse-io/gorse/commit/19fdcbb309fb5b609e9cc3eb10c74885b5b27da9 · Correção
• https://github.com/gorse-io/gorse/issues/1292 · Nota
• https://github.com/gorse-io/gorse/pull/1293 · Nota
• https://vulncheck.com/advisories/gorse-unauthenticated-database-dump-and-restore-via-api-dump-and-api-restore-endpoints · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-56782 · Nota de Segurança