CVE-2026-56782

Name of the Vulnerable Software and Affected Versions Gorse versions prior to 0.5.10

Description An authentication bypass exists in the HTTP API when the admin api key is left empty, which is the default configuration. This occurs because improper input validation treats an empty key as a disabling of access control for administrative routes. Remote attackers can exploit this by calling the '/api/dump' and '/api/restore' endpoints to exfiltrate the entire database, including user records and personally identifiable information, or completely overwrite the dataset.

Recommendations Update to version 0.5.10. As a temporary mitigation, ensure the admin api key is configured with a non-empty value to enable access control.