Medium severity5.4NVD Advisory· Published Nov 3, 2026· Updated Nov 3, 2026
CVE-2026-121455
CVE-2026-121455
Description
DbGate before 7.3.3 contains a missing authorization vulnerability that allows connection-restricted authenticated users to bypass LOGIN_PERMISSIONS because test() and save() never call testConnectionPermission. Attackers can submit arbitrary connection definitions to POST /connections/test to probe internal database hosts, or to /connections/save to overwrite stored connections.
Affected products
1Patches
Vulnerability mechanics
References
5- github.com/dbgate/dbgate/blob/v7.3.2/packages/api/src/controllers/connections.jsnvd
- github.com/dbgate/dbgate/blob/v7.3.2/packages/api/src/controllers/connections.jsnvd
- github.com/dbgate/dbgate/commit/9166a987bfecnvd
- github.com/dbgate/dbgate/issues/1601nvd
- www.vulncheck.com/advisories/dbgate-before-7.3.3-missing-authorization-via-connections-test-and-connections-savenvd
News mentions
0No linked articles in our index yet.