CVE-2026-95654
Databasement before 1.7.14 Authorization Bypass via Stale Invitation Token
- State
- Published
- Severity
- 9.1 Critical
- Published
- Sep 22, 2026
- Updated
- Sep 22, 2026
- Reserved
- Sep 22, 2026
Description
Databasement before 1.7.14 validates invitation tokens only when the acceptance page loads, caching the authorization decision without re-checking token validity during acceptance. Attackers with a leaked or forwarded invitation link can load the page while pending, then accept the invitation after the legitimate user has already accepted it to overwrite the account password and gain authenticated access to managed database credentials and secrets.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 9.1 Critical | CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 7.4 High | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N | VulnCheck |
Weaknesses
- CWE-863 Incorrect Authorization
Affected Products
| Product | Versions |
|---|---|
DatabasementDavid-Crty |
|
References
- Patch Commitpatch
- https://github.com/David-Crty/databasement/blob/v1.7.13/app/Livewire/Auth/AcceptInvitation.php#L30technical-description
- https://github.com/David-Crty/databasement/blob/v1.7.13/app/Livewire/Auth/AcceptInvitation.php#L45technical-description
- Databasement v1.7.14 Release Notesrelease-notes
- https://github.com/David-Crty/databasementproduct
- VulnCheck Advisory: Databasement before 1.7.14 Authorization Bypass via Stale Invitation Tokenthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.