CVE-2026-6215: DbGate REST/GraphQL openApiDriver.ts apiServerUrl1 server-side request forgery
A weakness has been identified in DbGate up to 7.1.4. The impacted element is the function apiServerUrl1 of the file packages/rest/src/openApiDriver.ts of the component REST/GraphQL. This manipulation causes server-side request forgery. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-6215?
CVE-2026-6215 has been classified as a medium severity vulnerability due to its potential for server-side request forgery.
How do I fix CVE-2026-6215?
To fix CVE-2026-6215, update DbGate to version 7.1.5 or later to mitigate the vulnerability.
What software versions are affected by CVE-2026-6215?
CVE-2026-6215 affects DbGate versions up to and including 7.1.4.
What is the impact of CVE-2026-6215?
The impact of CVE-2026-6215 allows an attacker to make unauthorized server-side requests, which could lead to data exposure.
What type of vulnerability is CVE-2026-6215?
CVE-2026-6215 is classified as a server-side request forgery (SSRF) vulnerability.