CVE-2026-56782

CRITICAL9.8

Gorse - Unauthenticated Database Dump and Restore via /api/dump and /api/restore Endpoints

Published Jun 29, 2026

Modified 1 weeks ago

Details

Gorse before 0.5.10 contains an authentication bypass vulnerability in the /api/dump and /api/restore endpoints that allows unauthenticated attackers to access protected functionality when admin_api_key is empty, which is the default configuration. Remote attackers can exfiltrate the entire database including user records, items, and feedback data containing personally identifiable information, or completely overwrite the dataset without authentication.

References

FIX

https://github.com/gorse-io/gorse/commit/19fdcbb309fb5b609e9cc3eb10c74885b5b27da9

WEB

https://github.com/gorse-io/gorse/issues/1292

WEB

https://github.com/gorse-io/gorse/pull/1293

ADVISORY

https://www.cve.org/CVERecord?id=CVE-2026-56782

ADVISORY

https://www.vulncheck.com/advisories/gorse-unauthenticated-database-dump-and-restore-via-api-dump-and-api-restore-endpoints

CVSS Analysis