---
id: CVE-2026-56782
title: >-
  Gorse - Unauthenticated Database Dump and Restore via /api/dump and
  /api/restore Endpoints
summary: >-
  Gorse before 0.5.10 contains an authentication bypass vulnerability in the
  /api/dump and /api/restore endpoints that allows unauthenticated attackers to
  access protected functionality when admin_api_key is empty, which is the
  default con…
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
cwe:
  - CWE-306
vendor: gorse-io
product: gorse
affected:
  - gorse < 0.5.10
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: total
  timestamp: '2026-06-29T19:41:24.574961Z'
exploitAvailable: true
published: '2026-06-29'
updated: '2026-11-08'
sourceUpdated: '2026-11-08T14:06:24.129Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-56782'
references:
  - url: 'https://github.com/gorse-io/gorse/issues/1292'
    label: Researcher Disclosure
  - url: 'https://github.com/gorse-io/gorse/pull/1293'
    label: Pull Request
  - url: >-
      https://github.com/gorse-io/gorse/commit/19fdcbb309fb5b609e9cc3eb10c74885b5b27da9
    label: Patch Commit
  - url: >-
      https://www.vulncheck.com/advisories/gorse-unauthenticated-database-dump-and-restore-via-api-dump-and-api-restore-endpoints
tags:
  - cve.org
  - exploit-available
epss: 0.03559
epssPercentile: 0.8941
exploits:
  github: 1
  githubRepos:
    - 'https://github.com/BiiTts/CVE-2026-56782-Gorse-Auth-Bypass'
  nuclei:
    - CVE-2026-56782
  checkedAt: '2026-11-08T14:51:57.334Z'
ingestedAt: '2026-11-08T14:51:22.333Z'
---

## Overview

Gorse before 0.5.10 contains an authentication bypass vulnerability in the /api/dump and /api/restore endpoints that allows unauthenticated attackers to access protected functionality when admin_api_key is empty, which is the default configuration. Remote attackers can exfiltrate the entire database including user records, items, and feedback data containing personally identifiable information, or completely overwrite the dataset without authentication.

## Affected

- `gorse < 0.5.10`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.