CVE-2026-56782CWE-306

Gorse - Unauthenticated Database Dump and Restore via /api/dump and /api/restore Endpoints

Critical · published June 29, 2026

CVSS v4.0
9.3
EPSS
4%
Percentile
89.3
In the wild
Unconfirmed
What it is

Gorse before 0.5.10 contains an authentication bypass vulnerability in the /api/dump and /api/restore endpoints that allows unauthenticated attackers to access protected functionality when admin_api_key is empty, which is the default configuration. Remote attackers can exfiltrate the entire database including user records, items, and feedback data containing personally identifiable information, or completely overwrite the dataset without authentication.

The record
Technical detail
CVSS v4.0
9.3 · CRITICAL
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.03559 · 89.3th percentile
Weakness
CWE-306 · Missing Authentication for Critical Function
Published
2026-06-29T17:16Z
EPSS history
Timeline
  • 29 JUN 17:16Z
    Gorse - Unauthenticated Database Dump and Restore via /api/dump and /api/restore Endpoints
    cvelistv5