CVE-2026-56782

Gorse - Unauthenticated Database Dump and Restore via /api/dump and /api/restore Endpoints

CVSS 9.3 CRITICALEPSS 0.9%CWE-306

Vexday Risk Score

48Attention

SSVC decision (CISA)

Attend

PoC available → attend closely

CVSS 9.3EPSS 0.9%KEV nãoPoC públicaNuclei —Metasploit —Patch referenciado

Lifecycle

29 Jun 2026Published on NVD

29 Jun 2026Public PoC

Recommendation: Plan a near-term fix — a public PoC already exists.

Gorse before 0.5.10 contains an authentication bypass vulnerability in the /api/dump and /api/restore endpoints that allows unauthenticated attackers to access protected functionality when admin_api_key is empty, which is the default configuration. Remote attackers can exfiltrate the entire database including user records, items, and feedback data containing personally identifiable information, or completely overwrite the dataset without authentication.

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Affected products

gorse-io · gorse

public PoCs found — 1

githubgithub.com/BiiTts/CVE-2026-56782-Gorse-Auth-Bypass★ 0

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

https://github.com/gorse-io/gorse/commit/19fdcbb309fb5b609e9cc3eb10c74885b5b27da9 https://github.com/gorse-io/gorse/issues/1292 https://github.com/gorse-io/gorse/pull/1293 https://www.vulncheck.com/advisories/gorse-unauthenticated-database-dump-and-restore-via-api-dump-and-api-restore-endpoints