Gorse before 0.5.10 contains an authentication bypass vulnerability in the /api/dump and /api/restore endpoints that allows attackers to access protected functionality when admin_api_key is empty (the default configuration). This enables remote attackers to exfiltrate the entire database including user records, items, and feedback data, or completely overwrite the dataset.
An unauthenticated attacker over the network can exfiltrate the entire database including user records, items, and feedback data containing personally identifiable information, or completely overwrite the dataset.
One proof-of-concept exploit is available on github.com. There is no evidence of proof of exploitation at the moment.
Upgrade Gorse to version 0.5.10 or later. Additionally, configure a strong admin_api_key value in the default configuration rather than leaving it empty.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD published the first details for CVE-2026-56782
A CVSS base score of 9.8 has been assigned.
Feedly found the first article mentioning CVE-2026-56782 . See article
GitHub Advisories released a security advisory .
A proof of concept exploit has been released
CVE-2026-56782 - Exploits & Severity - Feedly
BiiTts/CVE-2026-56782-Gorse-Auth-Bypass
Exploit for CVE-2026-56782
CVE-2026-56782 - Gorse - Unauthenticated Database Dump and Restore via /api/dump and /api/restore Endpoints CVE ID : CVE-2026-56782 Published : June 29, 2026, 5:16 p.m. | 3 hours, 56 minutes ago Description : Gorse before 0.5.10 contains an authentication bypass vulnerab...
Collect, analyze, and vulnerability reports faster using AI
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
