Loading vulnerability…
CVE-2026-56782 is an authentication bypass vulnerability affecting Gorse versions before 0.5.10. The flaw exists in the administrative /api/dump and /api/restore endpoints, which can be accessed without authentication when admin_api_key is empty; the provided content states this is the default configuration. As a result, protected administrative functionality is exposed to unauthenticated remote attackers. Successful exploitation allows an attacker to invoke database dump and restore operations, enabling full extraction of the Gorse dataset or replacement of its contents.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos (1 hidden).
This repository is a focused Python proof-of-concept for CVE-2026-56782 affecting Gorse versions prior to 0.5.10. The vulnerability is an authentication bypass in the Gorse master HTTP admin handlers: when admin_api_key is empty, checkAdmin() fails open and grants access to anyone. The exploit targets two master endpoints on the same HTTP service, typically port 8088: GET /api/dump for full database export and POST /api/restore for dataset overwrite. Repository structure is small and purpose-built: exploit.py is the main executable PoC; README.md documents the vulnerability, impact, reproduction steps, and raw requests; ANALYSIS.md explains the vulnerable route registration, fail-open logic, dump stream format, and patch behavior; EVIDENCE.txt records observed exploitation results against a vulnerable lab; lab/docker-compose.yml provides a reproducible environment using zhenghaoz/gorse-in-one:0.5.8 with host networking and seeded playground data. The exploit capability is twofold. First, it performs unauthenticated data exfiltration by requesting /api/dump with no X-API-Key header, then reading the binary stream format used by Gorse. It parses 8-byte little-endian signed section markers (-1 users, -2 items, -3 feedback, 0 EOF), reads length-prefixed protobuf records, counts records per section, and extracts sample field #1 strings such as user or item IDs. Second, it probes unauthorized write access by POSTing a minimal valid restore body consisting only of an EOF marker to /api/restore; any response other than 401 is treated as evidence that restore is reachable without authentication. This is a real exploit rather than a mere detector because it actively retrieves the dump stream and can save the raw exfiltrated data to disk. However, its restore action is limited to a no-op probe rather than destructive overwrite content, so the payload is basic and hardcoded, making the maturity OPERATIONAL rather than WEAPONIZED.
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
An unauthenticated database dump vulnerability affecting Gorse versions earlier than 0.5.10.
An authentication bypass vulnerability in Gorse before version 0.5.10 affecting the /api/dump and /api/restore endpoints, allowing unauthenticated database dump and restore when admin_api_key is empty by default.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.