CVE-2026-56782 AKAOMA CVE VULNERABILITIES / 14h Gorse before 0.5.10 contains an authentication bypass vulnerability in the /api/dump and /api/restore endpoints that allows unauthenticated attackers to access protected functionality when admin_api_key is empty, which is the default configuration. Remote attackers can exfiltrate the entire database including user records, items, and feedback data containing personally identifiable information, or completely overwrite the dataset without authentica

Back cve.akaoma.com

CVE-2026-56782 AKAOMA CVE VULNERABILITIES / 14h Gorse before 0.5.10 contains an authentication bypass vulnerability in the /api/dump and /api/restore endpoints that allows unauthenticated attackers to access protected functionality when admin_api_key is empty, which is the default configuration. Remote attackers can exfiltrate the entire database including user records, items, and feedback data containing personally identifiable information, or completely overwrite the dataset without authentica

cve.akaoma.com • June 30, 2026

Share: View original

9.8 /10 Critical Risk As a catastrophic security flaw, CVE-2026-56782 has severe implications, demanding immediate intervention.

As a catastrophic security flaw, CVE-2026-56782 has severe implications, demanding immediate intervention.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Authentication Bypass Vulnerability in Gorse Exposed Gorse versions prior to 0.5.10 contain a critical authentication bypass vulnerability (CVE-2026-56782) in the /api/dump and /api/restore endpoints. This flaw allows unauthenticated attackers to access sensitive data when the admin_api_key is left empty, which is the default setting. Attackers can exfiltrate the entire database, including personally identifiable information, or overwrite the dataset entirely. A proof-of-concept exploit was released on GitHub on June 30, 2026, raising concerns about potential exploitation. The CVSS base score for this vulnerability is 9.8, indicating a critical risk level. Users are advised to upgrade to version 0.5.10 or later and to set a strong admin_api_key to mitigate the risk. Currently, there is no evidence of active exploitation, but the situation remains urgent. 1 sources 78

Extracted Entities

Attack Types (1)

CVEs (1)

CWE Weaknesses (2)

CWE-200 - Exposure of Sensitive Information CWE-287 - Improper Authentication

MITRE ATT&CK (1)

T1041 - Exfiltration Over C2 Channel

Platforms (1)