Read the docs
TI-2026-65723 Aliases CVE-2026-103534GHSA-fw34-2f32-wm2m

David-Crty databasement Snapshot Model snapshots SnapshotPolicy.view access control

Priority MEDIUM 57CWE-266Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Privilege escalation, Security bypass
Confidentiality · integrity · availability
Low · Low · Low
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-266 and CWE-284.

Summary

A vulnerability was determined in David-Crty databasement up to 1.7.1. Affected is the function SnapshotPolicy.viewAny/SnapshotPolicy.view of the file /api/v1/snapshots of the component Snapshot Model. This manipulation causes improper access controls. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. Upgrading to version 1.7.2 is able to address this issue. The affected component should be upgraded.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00257 17th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA
Fix Fixed databasement (David-Crty): 1.7.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
David-Crtydatabasement1.7.0; 1.7.11.7.2Patch availableCNA
  • databasement VendorDavid-Crty Affected 1.7.0; 1.7.1 Fixed in 1.7.2 Patch available CNA

CPE names CNA · 1

CPEVersionsRoleVendor
cpe:2.3:a:david-crty:databasement:*:*:*:*:*:*:*:*———
  • cpe:2.3:a:david-crty:databasement:*:*:*:*:*:*:*:* Versions — — ·—

Remediation

  • Fix · CNA databasement (David-Crty) Fixed in 1.7.2

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-103534
  2. 2026-10-03 Alias added: GHSA-fw34-2f32-wm2m
  3. 2026-10-06 CISA SSVC decision points changed
  4. 2026-10-06 Priority changed: LOW → MEDIUM

References

Exploit 1

Patch 1

Other 1

  • TI-2026-85050 Databasement OIDC login bypass lets attackers take over accounts CVSS 4.0CRITICAL 9.2
  • TI-2026-70800 Argument injection in databasement allows remote code execution CVSS 3.1HIGH 8.8
  • TI-2026-76086 Missing authorization in David-Crty Databasement scheduled restore CVSS 4.0MEDIUM 5.1
  • TI-2026-65722 David-Crty databasement database-servers API Endpoint RestoreRequest.php 511 path traversal CVSS 4.0LOW 2.1
  • TI-2026-63662 Databasement before 1.7.14 Authorization Bypass via Stale Invitation Token CVSS 4.0CRITICAL 9.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences