CVE-2026-108710
Received Received - Intake

Authentication Bypass in NornicDB via Search Endpoints

Publication date: 2026-10-11

Last updated on: 2026-10-11

Assigner: VulnCheck

Description
NornicDB through 1.4.1 contains a missing authorization vulnerability that allows authenticated users to bypass per-database read restrictions on the /nornicdb/search and /nornicdb/similar endpoints. Viewer-role users allowlisted for a database but denied read can submit search queries or node IDs to retrieve node IDs, labels and full property maps.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-11
Last Modified
2026-10-11
Generated
2026-10-11
AI Q&A
2026-10-11
EPSS Evaluated
N/A
NVD
CVE-2026-108710
EUVD
EUVD-2026-96984

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
orneryd NornicDB 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

NornicDB through version 1.4.1 has a missing authorization vulnerability. Authenticated users with viewer-role permissions can bypass read restrictions on specific databases. They can access the /nornicdb/search and /nornicdb/similar endpoints to retrieve node IDs, labels, and full property maps even when explicitly denied read access.

Detection Guidance

To detect this vulnerability, monitor network traffic for unauthorized access attempts to the /nornicdb/search and /nornicdb/similar endpoints. Check logs for viewer-role users attempting to submit search queries or node IDs despite being denied read access.

Impact Analysis

This vulnerability allows unauthorized users to access sensitive data they shouldn't see. If you use NornicDB with viewer-role users, attackers could exploit this to extract confidential information from restricted databases, potentially leading to data breaches or compliance violations.

Compliance Impact

This vulnerability could lead to unauthorized data exposure, violating GDPR's data protection principles and HIPAA's access control requirements. Organizations using NornicDB may face compliance failures, regulatory penalties, and loss of trust due to potential data leaks from improper access controls.

Mitigation Strategies

Immediately update NornicDB to the latest version beyond 1.4.1. Review and enforce strict access controls for viewer-role users. Disable the affected endpoints if not required. Monitor for any suspicious activity related to these endpoints.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-108710. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart