CVE-2026-121939criticalCWE-290

CVE-2026-121939: falha crítica em David-Crty Databasement

Databasement before 1.10.9 Account Takeover via OIDC Email Auto-Linking

Publicada em

Seguir esta CVE+ Monitorar databasement

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

25Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 9.2
Databasement before 1.10.9 contains an authentication bypass vulnerability in OAuthService::findOrCreateLocalUser() that links OIDC identities to local users by email without checking email_verified. Attackers can register an identity provider account with a victim's unverified email to log in as any user, including the super-admin, and retain access after password resets.
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Produtos afetados
David-Crty · Databasement
CVEs relacionadas — David-Crty Databasement

No mesmo produto, das mais perigosas para as menos.

CVE-2026-95654CRITICALDatabasement before 1.7.14 Authorization Bypass via Stale Invitation TokenEPSS 0.5%CVE-2026-111875MEDIUMDavid-Crty Databasement Scheduled Restore SaveScheduledRestoreRequest.php authorizationEPSS 0.2%