CVE-2026-103534CWE-266CWE-284broken-access-control

CVE-2026-103534

Medium · published October 1, 2026

CVSS v3.1
6.3
EPSS
0%
Percentile
10.6
In the wild
Unconfirmed
What it is

A vulnerability was determined in David-Crty databasement up to 1.7.1. Affected is the function SnapshotPolicy.viewAny/SnapshotPolicy.view of the file /api/v1/snapshots of the component Snapshot Model. This manipulation causes improper access controls. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. Upgrading to version 1.7.2 is able to address this issue. The affected component should be upgraded.

The record
Technical detail
CVSS v3.1
6.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
CVSS v4.0
5.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
EPSS
0.00209 · 10.6th percentile
Weaknesses
CWE-266 · Incorrect Privilege Assignment; CWE-284 · Improper Access Control
Published
2026-10-01T08:18Z
References (8)
https://github.com/David-Crty/databasement/ · [email protected]https://github.com/David-Crty/databasement/releases/tag/v1.7.2 · [email protected]https://github.com/David-Crty/databasement/security/advisories/GHSA-vx6q-v2gv-5fhv · [email protected]https://vuldb.com/cve/CVE-2026-103534 · [email protected]https://vuldb.com/submit/957818 · [email protected]https://vuldb.com/vuln/412346 · [email protected]https://vuldb.com/vuln/412346/cti · [email protected]https://github.com/David-Crty/databasement/security/advisories/GHSA-vx6q-v2gv-5fhv · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 03 OCT 03:41Z
    EPSS moved — → 0%
    epss
  • 01 OCT 03:30Z
    David-Crty databasement Snapshot Model snapshots SnapshotPolicy.view access control
    cvelistv5