Read the docs
TI-2026-40946 Aliases CVE-2026-56782GHSA-65p2-39gr-3m25

Gorse - Unauthenticated Database Dump and Restore via /api/dump and /api/restore Endpoints

Priority MEDIUM 54CWE-306Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-306.

Summary

Gorse before 0.5.10 contains an authentication bypass vulnerability in the /api/dump and /api/restore endpoints that allows unauthenticated attackers to access protected functionality when admin_api_key is empty, which is the default configuration. Remote attackers can exfiltrate the entire database including user records, items, and feedback data containing personally identifiable information, or completely overwrite the dataset without authentication.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.03559 89th percentileScored 2026-11-07
Fix Fixed gorse (gorse-io): 0.5.10

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
gorse-iogorsebefore 0.5.100.5.10Patch availableCNA
  • gorse Vendorgorse-io Affected before 0.5.10 Fixed in 0.5.10 Patch available CNA

Remediation

  • Fix · CNA gorse (gorse-io) Fixed in 0.5.10

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-56782
  2. 2026-10-03 Alias added: GHSA-65p2-39gr-3m25

References

Patch 2

Other 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences