CVE-2026-103534: David-Crty databasement Snapshot Model snapshots SnapshotPolicy.view access control
A vulnerability was determined in David-Crty databasement up to 1.7.1. Affected is the function SnapshotPolicy.viewAny/SnapshotPolicy.view of the file /api/v1/snapshots of the component Snapshot Model. This manipulation causes improper access controls. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. Upgrading to version 1.7.2 is able to address this issue. The affected component should be upgraded.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
David-Crty databasementto a version that resolves this vulnerability.Fixed in 1.7.2
Event History
Frequently Asked Questions
Which deployments are affected?
David-Crty databasement versions up to and including 1.7.1 are affected in the Snapshot Model's /api/v1/snapshots endpoint, specifically SnapshotPolicy.viewAny and SnapshotPolicy.view.
What level of access does an attacker need?
The vulnerability is remotely exploitable and requires low privileges. No user interaction is required.
Is exploit code available?
Yes. The exploit has been publicly disclosed and may be used by attackers.
What should teams do to remediate the issue?
Upgrade David-Crty databasement to version 1.7.2. The available data identifies this upgrade as the fix for the affected Snapshot Model access controls.