CVE-2026-56782

Gorse before 0.5.10 contains an authentication bypass vulnerability in the /api/dump and /api/restore endpoints that allows unauthenticated attackers to access protected functionality when admin_api_key is empty, which is the default configuration. Remote attackers can exfiltrate the entire database including user records, items, and feedback data containing personally identifiable information, or completely overwrite the dataset without authentication.

CVSS v4.0

9.3 CRITICALCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS v3.1

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

3.56% chance of exploitation in the next 30 days, 89th percentile

Nuclei

critical · CWE-306

Published

2026-06-29

Updated

2026-07-14

Proof-of-concept exploits (1)

• BiiTts/CVE-2026-56782-Gorse-Auth-Bypass

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-56782.yaml

References

• CVE Record
• NVD entry

Related

• CVE-2025-1974
• CVE-2025-49113
• CVE-2026-12940
• CVE-2026-44789
• CVE-2026-46490
• CVE-2026-49230