CVE-2026-111875: David-Crty Databasement Scheduled Restore SaveScheduledRestoreRequest.php authorization
A vulnerability has been found in David-Crty Databasement up to 1.8.1. Affected by this vulnerability is an unknown functionality of the file app/Http/Requests/Api/V1/SaveScheduledRestoreRequest.php of the component Scheduled Restore. Such manipulation of the argument schemaname leads to missing authorization. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.8.2 addresses this issue. It is suggested to upgrade the affected component.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
David-Crty Databasementto a version that resolves this vulnerability.Fixed in 1.8.2
Event History
Frequently Asked Questions
Which deployments are affected?
David-Crty Databasement versions up to and including 1.8.1 are affected. Version 1.8.2 addresses the issue.
What does an attacker need to exploit this issue?
The issue can be exploited remotely by manipulating the schema_name argument in the Scheduled Restore component. The provided data does not specify any required authentication level or user interaction.
Is public exploit information available?
Yes. Exploit details have been publicly disclosed and may be used.
What should teams do if they are running an affected version?
Upgrade David-Crty Databasement to version 1.8.2. The provided information does not describe a workaround or mitigation for environments that cannot immediately upgrade.