Authorization Bypass in Databasement Affected by Stale Invitation Token

CVE-2026-95654

What is CVE-2026-95654?

The Databasement product prior to version 1.7.14 contains an authorization bypass vulnerability due to flawed token validation. Specifically, invitation tokens are only validated when the acceptance page is loaded for the first time. If an attacker gains access to a leaked or forwarded invitation link, they may exploit this by loading the acceptance page while the invitation is still pending. Once the legitimate user accepts the invitation, the attacker can subsequently accept the invitation to overwrite the user's account password and gain unauthorized access to sensitive database credentials and secrets, compromising the overall security of the affected system.

References