Vulnerability · Published Oct 1, 2026 · Assigned by VulDB

CVE-2026-103534David-Crty databasement Snapshot Model snapshots SnapshotPolicy.view access control

Medium 6.3

In plain English

A medium-severity improper access control in databasement from David-Crty. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 17% of all known vulnerabilities).

Severity (CVSS 3.1)6.3Medium

Exploit odds (30 days)0.3%top 82.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A vulnerability was determined in David-Crty databasement up to 1.7.1. Affected is the function SnapshotPolicy.viewAny/SnapshotPolicy.view of the file /api/v1/snapshots of the component Snapshot Model. This manipulation causes improper access controls. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. Upgrading to version 1.7.2 is able to address this issue. The affected component should be upgraded.

Affected products (as reported)

Vendor	Product	Versions
David-Crty	databasement	1.7.01.7.1

Weakness: CWE-284, CWE-266 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C

References

VDB-412346 | David-Crty databasement Snapshot Model snapshots SnapshotPolicy.view access control vdb-entry, technical-description
VDB-412346 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
CVE-2026-103534 | CVE Analysis and Report third-party-advisory
Submit #957818 | David-Crty Databasement >= 1.2.0, < 1.7.2 Improper Access Controls third-party-advisory
https://github.com/David-Crty/databasement/security/advisories/GHSA-vx6q-v2gv-5fhv exploit
https://github.com/David-Crty/databasement/releases/tag/v1.7.2 patch
https://github.com/David-Crty/databasement/ product