Gorse <0.5.10 Authentication Bypass Vulnerability
Gorse versions prior to 0.5.10 appear to contain a critical authentication bypass vulnerability affecting the /api/dump and /api/restore endpoints. This vulnerability is under investigation and could allow unauthenticated remote attackers to access protected functionality.
What happened
Gorse before version 0.5.10 is reportedly affected by an authentication bypass vulnerability in the /api/dump and /api/restore endpoints. When the admin_api_key is empty, which is the default configuration, unauthenticated attackers may be able to access protected functionality. This could allow remote attackers to exfiltrate the entire database, including user records and personally identifiable information, or overwrite the dataset without authentication.
The severity of this vulnerability is rated as CRITICAL with a CVSS score of 9.8. The recommended action to mitigate the risk is to upgrade to Gorse version 0.5.10 or later. For more detailed information, primary sources should be consulted.
How 0Day mitigates this
gorse is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.