CVE-2026-103244CWE-306

CVE-2026-103244

Critical · published October 1, 2026

CVSS v3.1
9.8
EPSS
1%
Percentile
46.2
In the wild
Unconfirmed
What it is

ground-station versions before 0.8.0 contain an authentication bypass vulnerability in the setup.restore command that allows unauthenticated attackers to execute arbitrary SQL during first-run setup mode. Attackers can invoke setup.restore via Socket.IO to plant admin users and forged session tokens, then authenticate as administrator without credentials for complete application takeover.

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
9.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00565 · 46.2th percentile
Weakness
CWE-306 · Missing Authentication for Critical Function
Published
2026-10-01T15:17Z
References (4)
https://github.com/sgoudelis/ground-station/commit/940df2128e57fa779d0ddee2d9726bd829fc61e1 · [email protected]https://github.com/sgoudelis/ground-station/security/advisories/GHSA-3mqj-q84c-crjq · [email protected]https://www.vulncheck.com/advisories/ground-station-before-0.8.0-authentication-bypass-via-setup-restore · [email protected]https://github.com/sgoudelis/ground-station/security/advisories/GHSA-3mqj-q84c-crjq · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 03 OCT 03:41Z
    EPSS moved — → 1%
    epss
  • 01 OCT 10:41Z
    ground-station before 0.8.0 Authentication Bypass via setup.restore
    cvelistv5