CVE Intelligence
Analysis AI-assisted

CVE-2026-56782: Gorse Missing Authentication on Database Dump and Restore APIs

Gorse versions before 0.5.10 expose the /api/dump and /api/restore endpoints without authentication when admin_api_key is empty, which is the default configuration. An unauthenticated remote attacker could read the full database, including user records and feedback containing personal data, or overwrite the dataset. The record rates it critical with CVSS 3.1 score 9.8, and no confirmed exploitation appears in the sources consulted.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

CVE-2026-56782 is a missing authentication issue (CWE-306) in the Gorse recommender system. According to the record, the /api/dump and /api/restore endpoints can be reached without credentials when the admin_api_key setting is empty, which the description says is the default configuration. The description states that the flaw affects versions before 0.5.10.

Impact

  • Confidentiality: the record states that a remote attacker could export the entire database, including user records, items and feedback data that may contain personally identifiable information.
  • Integrity: the record states that the dataset could be completely overwritten without authentication.
  • Availability: the record's CVSS 3.1 vector rates availability impact as high, but the record does not describe a specific availability outcome.
  • The record assigns CVSS 3.1 score 9.8 (critical) and CVSS 4.0 score 9.3, both from the CNA VulnCheck.

Affected products and versions

  • Product: Gorse, as described in the record.
  • Affected range: versions before 0.5.10, according to the description.
  • The structured affected-products list in the record is empty, so exact package names and version ranges should be confirmed against the vendor references.
  • No fixed-version field is populated in the record. The description's boundary at 0.5.10 suggests that 0.5.10 or later is not affected, but this is an inference and should be verified in the linked GitHub issue, commit and pull request.

Exploitation status

The CISA KEV catalog does not list this CVE in the record. No confirmed exploitation appears in the sources consulted. The EPSS probability is 0.03559 with a percentile of 0.89069, as reported in the record; EPSS is an estimate and does not confirm exploitation.

Remediation and mitigation

  • Upgrade Gorse to version 0.5.10 or later. The fixed-version boundary is taken from the description and should be confirmed against the vendor references.
  • Until upgrading is possible, set a strong, non-empty admin_api_key so that the administrative endpoints are not left unprotected by default, and restrict network access to the Gorse API to trusted hosts.
  • Review whether data stored in Gorse, especially user records and feedback, has been exposed, and follow your internal incident and data protection procedures if exposure is suspected.

Detection guidance

  • Review web server and application logs for requests to the /api/dump and /api/restore paths, especially those originating from unexpected or external addresses and those without authentication.
  • Alert on unusual volume or size of responses from these endpoints and on unexpected changes to stored datasets.
  • Verify the configuration state of admin_api_key across deployments to identify instances where it is empty.

Limitations of the available information

  • The record does not list affected or fixed versions in structured fields.
  • The record's source status is Deferred, so the assessment may be incomplete.
  • The EPSS date in the record is later than the publication date; the meaning of that date is unknown.
  • The record does not provide exploitation evidence, proof-of-concept details or vendor statements beyond the listed references.

Frequently asked questions

What is CVE-2026-56782?

It is a missing authentication vulnerability (CWE-306) in Gorse before 0.5.10. The /api/dump and /api/restore endpoints can be reached without credentials when admin_api_key is empty, which the record says is the default configuration.

Is this vulnerability known to be actively exploited?

The CVE is not listed in the CISA KEV catalog in this record, and no confirmed exploitation appears in the sources consulted.

What should administrators do?

Upgrade Gorse to version 0.5.10 or later, set a strong non-empty admin_api_key as an interim measure, and restrict network access to the API to trusted hosts.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.