CVE-2026-56782
published 2026-06-29CVE-2026-56782: Gorse before 0.5.10 contains an authentication bypass vulnerability in the /api/dump and /api/restore endpoints that allows unauthenticated attackers to access…
PriorityP181critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EXPLOIT
EPSS
3.56%
88.6th percentile
Gorse before 0.5.10 contains an authentication bypass vulnerability in the /api/dump and /api/restore endpoints that allows unauthenticated attackers to access protected functionality when admin_api_key is empty, which is the default configuration. Remote attackers can exfiltrate the entire database including user records, items, and feedback data containing personally identifiable information, or completely overwrite the dataset without authentication.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| gorse-io | gorse | < 0.5.10 | 0.5.10 |
Detection & IOCsextracted from sources · hover to see the quote
- →Send unauthenticated GET /api/dump; a vulnerable Gorse instance returns HTTP 200 with Content-Type: application/octet-stream and no 'unauthorized' body string. ↗
- →Fingerprint the target first by checking that the HTTP 200 response body contains the string 'gorse' (case-insensitive) before probing the dump endpoint. ↗
- →Use FOFA query 'title="Gorse Dashboard"' to discover internet-exposed Gorse instances for mass scanning. ↗
- ·The authentication bypass is only exploitable when admin_api_key is empty, which is the default configuration. Instances with a non-empty admin_api_key are not affected. ↗
- ·Both /api/dump (read) and /api/restore (write) are exposed; attackers can exfiltrate the full database OR completely overwrite it without credentials. ↗
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv4.09.3CRITICALCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Gorse before 0.5.10 contains an authentication bypass vulnerability in the /api/dump and /api/restore endpoints that allows unauthenticated attackers to access protected functionality when admin_api_k
ghsa_unreviewed·2026-06-29
CVE-2026-56782 [CRITICAL] CWE-306 Gorse before 0.5.10 contains an authentication bypass vulnerability in the /api/dump and /api/restore endpoints that allows unauthenticated attackers to access protected functionality when admin_api_k
Gorse before 0.5.10 contains an authentication bypass vulnerability in the /api/dump and /api/restore endpoints that allows unauthenticated attackers to access protected functionality when admin_api_key is empty, which is the default configuration. Remote attackers can exfiltrate the entire database including user records, items, and feedback data containing personally identifiable information, or completely overwrite the dataset without authentication.
VulDB
gorse-io gorse up to 0.5.9 /api/dump missing authentication (Issue 1292 / EUVD-2026-40158)
vuldb·2026-06-29·CVSS 9.8
CVE-2026-56782 [CRITICAL] gorse-io gorse up to 0.5.9 /api/dump missing authentication (Issue 1292 / EUVD-2026-40158)
A vulnerability identified as critical has been detected in gorse-io gorse up to 0.5.9. This vulnerability affects unknown code of the file /api/dump. The manipulation leads to missing authentication.
This vulnerability is listed as CVE-2026-56782. The attack may be initiated remotely. There is no available exploit.
You should upgrade the affected component.
No detection rules found.
Nuclei
Gorse < 0.5.10 - Unauthenticated Database Dump
nuclei·CVSS 9.8
CVE-2026-56782 [CRITICAL] Gorse < 0.5.10 - Unauthenticated Database Dump
Gorse < 0.5.10 - Unauthenticated Database Dump
Gorse < 0.5.10 contains an authentication bypass caused by empty admin_api_key in /api/dump and /api/restore endpoints, letting unauthenticated remote attackers access and modify protected data, exploit requires default empty admin_api_key configuration.
Template:
id: CVE-2026-56782
info:
name: Gorse < 0.5.10 - Unauthenticated Database Dump
author: 0x_Akoko
severity: critical
description: |
Gorse < 0.5.10 contains an authentication bypass caused by empty admin_api_key in /api/dump and /api/restore endpoints, letting unauthenticated remote attackers access and modify protected data, exploit requires default empty admin_api_key configuration.
impact: |
Remote attackers can exfiltrate or overwrite the entire database including sensitive user
No writeups or analysis indexed.
2026-06-29
Published