CVE-2026-121455
DbGate before 7.3.3 contains a missing authorization vulnerability that allows connection-restricted authenticated users to bypass LOGIN_PER
CVSS
5.4
Medio
EPSS
—
KEV
—
Exploit Today
—
0-100
Publicado: 3 nov 2026 · Última mod.: 3 nov 2026 · CWE-862
Sin historial EPSS suficiente todavía.
DbGate before 7.3.3 contains a missing authorization vulnerability that allows connection-restricted authenticated users to bypass LOGIN_PERMISSIONS because test() and save() never call testConnectionPermission. Attackers can submit arbitrary connection definitions to POST /connections/test to probe internal database hosts, or to /connections/save to overwrite stored connections.
- github.comhttps://github.com/dbgate/dbgate
- github.comhttps://github.com/dbgate/dbgate/blob/v7.3.2/packages/api/src/controllers/connections.js#L227-L250
- github.comhttps://github.com/dbgate/dbgate/blob/v7.3.2/packages/api/src/controllers/connections.js#L372-L390
- github.comhttps://github.com/dbgate/dbgate/commit/9166a987bfec
- github.comhttps://github.com/dbgate/dbgate/issues/1601
- www.vulncheck.comhttps://www.vulncheck.com/advisories/dbgate-before-7.3.3-missing-authorization-via-connections-test-and-connections-save
CVECVSSEPSSKEVRExplotTítuloVis.
CVE-2026-970724.3 MED—
———Missing Authorization vulnerability in myCred myCred mycred allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects myCred: from n/a through 4.0.2.6hCVE-2026-397774.3 MED—
———Missing Authorization vulnerability in WC Lovers WCFM Membership wc-multivendor-membership allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WCFM Membership: from n/a through 2.12.0.6hCVE-2026-397435.3 MED—
———Missing Authorization vulnerability in WC Lovers WCFM Membership wc-multivendor-membership allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WCFM Membership: from n/a through 2.12.0.6hCVE-2026-1208465.3 MED—
———Missing Authorization vulnerability in Uncanny Owl Uncanny Automator uncanny-automator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Uncanny Automator: from n/a through 7.7.1.6hCVE-2026-1195095.3 MED—
———Missing Authorization vulnerability in eranfl ClickCease Click Fraud Protection clickcease-click-fraud-protection allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ClickCease Click Fraud Protection: from n/a through 3.3.0.6hCVE-2026-1194955.3 MED—
———Missing Authorization vulnerability in WebberZone Better Search better-search allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Better Search: from n/a through 4.5.2.6h