CVE-2026-56782: Gorse - Unauthenticated Database Dump and Restore via /api/dump and /api/restore Endpoints
Gorse before 0.5.10 contains an authentication bypass vulnerability in the /api/dump and /api/restore endpoints that allows unauthenticated attackers to access protected functionality when adminapikey is empty, which is the default configuration. Remote attackers can exfiltrate the entire database including user records, items, and feedback data containing personally identifiable information, or completely overwrite the dataset without authentication.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
gorseto a version that resolves this vulnerability.Fixed in 0.5.10 - Configuration
Set the Gorse admin_api_key to a non-empty value to prevent unauthenticated access to the /api/dump and /api/restore endpoints when the default configuration leaves it empty.
Gorse admin_api_key = non-empty
Event History
Frequently Asked Questions
What is the severity of CVE-2026-56782?
CVE-2026-56782 has a critical severity rating of 9.8.
How do I fix CVE-2026-56782?
To fix CVE-2026-56782, ensure that an admin_api_key is configured and not left empty.
What are the affected software versions for CVE-2026-56782?
CVE-2026-56782 affects Gorse versions before 0.5.10.
What type of vulnerability is CVE-2026-56782?
CVE-2026-56782 is an authentication bypass vulnerability.
What can attackers do with CVE-2026-56782?
Attackers can exfiltrate the entire database via unauthenticated access to the /api/dump and /api/restore endpoints.