PT-2026-53659 · Gorse Io · Gorse

George Chen · Published 2026-06-29 · Updated 2026-06-29 · CVE-2026-56782

NVD

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Gorse before 0.5.10 contains an authentication bypass vulnerability in the /api/dump and /api/restore endpoints that allows unauthenticated attackers to access protected functionality when admin api key is empty, which is the default configuration. Remote attackers can exfiltrate the entire database including user records, items, and feedback data containing personally identifiable information, or completely overwrite the dataset without authentication.

Fix

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2026-56782

Affected Products

Gorse

References · 5

• https://github.com/gorse-io/gorse/commit/19fdcbb309fb5b609e9cc3eb10c74885b5b27da9 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-56782 · Security Note
• https://github.com/gorse-io/gorse/issues/1292 · Note
• https://github.com/gorse-io/gorse/pull/1293 · Note
• https://vulncheck.com/advisories/gorse-unauthenticated-database-dump-and-restore-via-api-dump-and-api-restore-endpoints · Note