Missing Authorization Vulnerability in NornicDB by Orneryd
CVE-2026-108710

7.1HIGH

Key Information:

Vendor

Orneryd

Status
Nornicdb
Vendor
CVE Published:
11 October 2026

What is CVE-2026-108710?

NornicDB versions up to and including 1.4.1 have a missing authorization vulnerability that can be exploited by authenticated users with the 'viewer' role. This flaw allows users who have been allowed access to a specific database, but denied permission to read, to bypass these restrictions. They are able to submit search queries or node IDs to the /nornicdb/search and /nornicdb/similar endpoints and retrieve sensitive information, including node IDs, labels, and full property maps. This vulnerability poses significant risks, enabling unauthorized access to data that should be restricted.

Affected Version(s)

NornicDB 0 <= 1.4.1

References

https://hackmd.io/@haind/orneryd-nornicdb-vector-endpoint...
third-party-advisory
https://github.com/orneryd/NornicDB/blob/67105489e6da0071...
technical-description
https://github.com/orneryd/NornicDB/blob/67105489e6da0071...
technical-description

CVSS V4

Score:
7.1
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

HaiND from the Post and Telecommunication Institute of Technology
.