CVE-2026-121455: DbGate before 7.3.3 Missing Authorization via /connections/test and /connections/save
DbGate before 7.3.3 contains a missing authorization vulnerability that allows connection-restricted authenticated users to bypass LOGINPERMISSIONS because test() and save() never call testConnectionPermission. Attackers can submit arbitrary connection definitions to POST /connections/test to probe internal database hosts, or to /connections/save to overwrite stored connections.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
DbGateto a version that resolves this vulnerability.Fixed in 7.3.3
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated user whose access is restricted by LOGIN_PERMISSIONS can exploit it. The attacker needs network access to the DbGate instance and valid credentials, but does not need additional user interaction.
What can an attacker do through the affected endpoints?
By sending arbitrary connection definitions to POST /connections/test, an attacker can probe internal database hosts. Through POST /connections/save, they can overwrite stored connection definitions.
Are installations before 7.3.3 affected by default?
The issue affects DbGate versions before 7.3.3 when LOGIN_PERMISSIONS are relied on to restrict a user's connection access. The vulnerable test() and save() paths do not enforce the expected connection-permission check.
How can I determine whether my deployment is affected?
Check whether the DbGate version is earlier than 7.3.3 and whether connection-restricted users are configured through LOGIN_PERMISSIONS. In an affected deployment, such a user may be able to submit connection definitions to /connections/test or /connections/save despite those restrictions.