Vulnerability · Published Jun 29, 2026 · Assigned by VulnCheck

CVE-2026-56782Gorse - Unauthenticated Database Dump and Restore via /api/dump and /api/restore Endpoints

Critical 9.8

In plain English

A critical-severity missing authentication in gorse from gorse-io. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 3.6% (higher than 89% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei, public proof-of-concept code.

Severity (CVSS 3.1)9.8Critical

Exploit odds (30 days)3.6%top 10.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack tooling2Nuclei, Public PoC

Official description

Gorse before 0.5.10 contains an authentication bypass vulnerability in the /api/dump and /api/restore endpoints that allows unauthenticated attackers to access protected functionality when admin_api_key is empty, which is the default configuration. Remote attackers can exfiltrate the entire database including user records, items, and feedback data containing personally identifiable information, or completely overwrite the dataset without authentication.

Affected products (as reported)

Vendor	Product	Versions
gorse-io	gorse	0 – before 0.5.10

Weakness: CWE-306 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

Researcher Disclosure issue-tracking
Pull Request issue-tracking
Patch Commit patch
https://www.vulncheck.com/advisories/gorse-unauthenticated-database-dump-and-restore-via-api-dump-and-api-restore-endpoints third-party-advisory