CVE-2026-95654: Databasement before 1.7.14 Authorization Bypass via Stale Invitation Token
Databasement before 1.7.14 validates invitation tokens only when the acceptance page loads, caching the authorization decision without re-checking token validity during acceptance. Attackers with a leaked or forwarded invitation link can load the page while pending, then accept the invitation after the legitimate user has already accepted it to overwrite the account password and gain authenticated access to managed database credentials and secrets.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Databasement deployments before 1.7.14 are exposed when an invitation link is leaked or forwarded. The attacker does not need an existing account or authenticated access.
What does an attacker need to do to exploit it?
They need a valid invitation link while it is still pending and must load its acceptance page before the legitimate recipient accepts the invitation. They can then submit acceptance after the legitimate acceptance, overwriting the account password.
What access can exploitation provide?
Successful exploitation gives the attacker authenticated access to the invited account, including access to managed database credentials and secrets available to that account.
How can I tell whether an invitation may have been abused?
The provided information does not identify specific logs or indicators. Review whether invitation links may have been exposed and investigate unexpected password changes or authenticated access to affected invited accounts.