Authentication Bypass in Gorse API for Database Management

CVE-2026-56782

What is CVE-2026-56782?

Gorse versions before 0.5.10 are susceptible to an authentication bypass vulnerability affecting the /api/dump and /api/restore endpoints. This security flaw enables remote attackers to gain unauthorized access to sensitive database functionalities when the admin_api_key is left empty, which is the default setting. Exploiting this vulnerability, attackers can exfiltrate complete database contents including user records, items, and feedback data containing personally identifiable information (PII), or they can overwrite the dataset entirely without the need for authentication.

References