CVE-2026-121455 Details
Description
DbGate before 7.3.3 contains a missing authorization vulnerability that allows connection-restricted authenticated users to bypass LOGIN_PERMISSIONS because test() and save() never call testConnectionPermission. Attackers can submit arbitrary connection definitions to POST /connections/test to probe internal database hosts, or to /connections/save to overwrite stored connections.
A missing authorization vulnerability exists in DbGate versions prior to 7.3.3. This vulnerability allows connection-restricted authenticated users to bypass specified login permissions. The issue arises because the 'test()' and 'save()' methods in the connections controller do not invoke 'testConnectionPermission', which is essential for enforcing connection-based access controls. As a result, users can exploit this oversight by sending arbitrary connection definitions to the '/connections/test' endpoint, probing internal database hosts, or using the '/connections/save' endpoint to overwrite existing connection records.
Users can update to DbGate version 7.3.3 or later, where this vulnerability has been addressed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Nov 3, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/dbgate/dbgate | [email protected] | ProductVendor |
| https://github.com/dbgate/dbgate/blob/v7.3.2/packages/api/src/controllers/connections.js#L227-L250 | [email protected] | Source CodeVendor |
| https://github.com/dbgate/dbgate/blob/v7.3.2/packages/api/src/controllers/connections.js#L372-L390 | [email protected] | Source CodeVendor |
| https://github.com/dbgate/dbgate/commit/9166a987bfec | [email protected] | Source CodeVendor |
| https://github.com/dbgate/dbgate/issues/1601 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://www.vulncheck.com/advisories/dbgate-before-7.3.3-missing-authorization-via-connections-test-and-connections-save | [email protected] | AdvisoryRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-862 | Missing Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| DbGate | >= 0, < 7.3.3 |
CPE
Remediation
| |
Change History
1 change record found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 3, 2026 | New CVE Received | [email protected] |