Authentication Bypass in Gorse Exposes Database

Impact Analysis

This vulnerability can have severe impacts as it allows attackers to remotely access and extract the entire database, which may contain sensitive and personally identifiable information.

Additionally, attackers can overwrite or inject malicious data into the dataset, potentially corrupting recommendations or poisoning the system's model, leading to data integrity issues and loss of trust in the system.

Useful 0 Not Useful 0

Executive Summary

CVE-2026-56782 is a critical authentication bypass vulnerability in Gorse versions before 0.5.10. It affects the /api/dump and /api/restore endpoints, which allow unauthenticated attackers to access protected functionality if the admin_api_key is empty, which is the default configuration.

This flaw enables remote attackers to either exfiltrate the entire database, including sensitive user records, items, and feedback data containing personally identifiable information, or to overwrite the dataset completely without any authentication.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by checking if the Gorse server exposes the /api/dump and /api/restore endpoints without requiring authentication, especially when the admin_api_key is empty (default configuration). An unauthenticated request to these endpoints that returns data or allows data modification indicates the presence of the vulnerability.

You can use simple HTTP commands to test these endpoints for unauthorized access.

• Use curl to test the /api/dump endpoint for data exfiltration: curl -v http://<gorse-server>/api/dump
• Use curl to test the /api/restore endpoint for unauthorized data overwrite (be cautious with this test): curl -v -X POST http://<gorse-server>/api/restore -d '<test-data>'

If these commands succeed without authentication and return data or accept data, the system is vulnerable.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include:

• Set a non-empty admin_api_key configuration to enforce authentication on the /api/dump and /api/restore endpoints.
• Upgrade Gorse to version 0.5.10 or later, where the vulnerability is patched by replacing the admin_api_key check with a login-based authentication mechanism.
• Restrict network access to the affected endpoints by firewall rules or network segmentation to prevent unauthorized external access.
• Review and apply the official patch or update from the Gorse project that replaces the vulnerable authentication checks with secure login verification.

Useful 0 Not Useful 0