CVE-2026-111875 Details
Description
A vulnerability has been found in David-Crty Databasement up to 1.8.1. Affected by this vulnerability is an unknown functionality of the file app/Http/Requests/Api/V1/SaveScheduledRestoreRequest.php of the component Scheduled Restore. Such manipulation of the argument schema_name leads to missing authorization. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.8.2 addresses this issue. It is suggested to upgrade the affected component.
A vulnerability exists in David-Crty Databasement versions through 1.8.1, specifically within the Scheduled Restore component. The issue arises in the file 'app/Http/Requests/Api/V1/SaveScheduledRestoreRequest.php', where the 'schema_name' argument is manipulated, leading to missing authorization. This vulnerability allows authenticated users with the 'operate-restores' ability to overwrite files on the server via the REST API, particularly targeting SQLite databases. The flaw is due to a lack of proper validation in the API compared to the application’s user interface, creating an inconsistency that can be exploited remotely.
Upgrading to David-Crty Databasement version 1.8.2 addresses this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 18, 2026CISA-ADP
Assessed Oct 19, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/David-Crty/databasement/ | [email protected] | Vendor |
| https://github.com/David-Crty/databasement/releases/tag/v1.8.2 | [email protected] | Release NotesVendor |
| https://github.com/David-Crty/databasement/security/advisories/GHSA-3rjj-69wh-r95f | [email protected] | AdvisoryExploitRemedyVendor |
| https://vuldb.com/cve/CVE-2026-111875 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/submit/1005220 | [email protected] | Issue TrackingPermission Required |
| https://vuldb.com/vuln/421587 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/vuln/421587/cti | [email protected] | Content Wall |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-862 | Missing Authorization | [email protected] |
| CWE-863 | Incorrect Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| David-Crty Databasement | >= 1.3.0, < 1.8.2 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 19, 2026 | CVE Modified | CISA-ADP |
| Oct 18, 2026 | New CVE Received | [email protected] |