CVE-2026-111875
Deferred Deferred - Pending Action

Missing Authorization in Databasement via SaveScheduledRestoreRequest

Publication date: 2026-10-18

Last updated on: 2026-10-18

Assigner: VulDB

Description
A vulnerability has been found in David-Crty Databasement up to 1.8.1. Affected by this vulnerability is an unknown functionality of the file app/Http/Requests/Api/V1/SaveScheduledRestoreRequest.php of the component Scheduled Restore. Such manipulation of the argument schema_name leads to missing authorization. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.8.2 addresses this issue. It is suggested to upgrade the affected component.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-18
Last Modified
2026-10-18
Generated
2026-10-18
AI Q&A
2026-10-18
EPSS Evaluated
N/A
NVD
CVE-2026-111875
EUVD
EUVD-2026-103386

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
David-Crty Databasement 1.8.0
David-Crty Databasement 1.8.1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-111875 is an arbitrary file write vulnerability in the Databasement ScheduledRestore API. The issue occurs because the schema_name field in API requests lacks proper path validation, unlike the same field in the Livewire UI which enforces SafeDatabasePath rules. This allows authenticated users with the operate-restores ability to write files to any writable path accessible by the queue-worker process by supplying a malicious schema_name during scheduled restore creation or updates. The vulnerability specifically affects SQLite targets where schema_name becomes the destination file path.

Detection Guidance

Check for unauthorized file writes in writable directories like /data/, home directories, or SSH authorized keys. Review API logs for requests to POST /api/v1/scheduled-restores, PUT /api/v1/scheduled-restores/{id}, or RunScheduledRestores cron commands with unusual schema_name values. Verify if any files were created or modified outside expected backup paths.

Impact Analysis

This vulnerability can lead to data corruption, shell configuration file overwrites, or SSH key injection depending on the deployment environment. While the most dangerous scenario of writing a PHP file to the webroot for code execution is mitigated, other writable locations remain vulnerable. The exploit requires only the operate-restores permission, which is granted to standard operators who already have significant control over databases.

Compliance Impact

This vulnerability could impact compliance with GDPR and HIPAA by enabling unauthorized file writes, potentially leading to data corruption, unauthorized access, or exposure of sensitive data. GDPR requires protecting personal data integrity and confidentiality, while HIPAA mandates safeguarding protected health information. The ability to overwrite files or inject malicious content may violate these standards if sensitive data is compromised or altered.

Mitigation Strategies

Upgrade to Databasement version 1.8.2 or later immediately. Review and restrict the operate-restores permission to only trusted users. Monitor file system changes in writable directories and audit API access logs for suspicious activity.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-111875. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart