{"id":"CVE-2026-111875","kind":"vulnerability","aliases":["CVE-2026-111875"],"related":[],"title":"Databasement: scheduled restore API lacks authorization, letting remote callers act","description":"A vulnerability has been found in David-Crty Databasement up to 1.8.1. Affected by this vulnerability is an unknown functionality of the file app/Http/Requests/Api/V1/SaveScheduledRestoreRequest.php of the component Scheduled Restore. Such manipulation of the argument schema_name leads to missing authorization. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.8.2 addresses this issue. It is suggested to upgrade the affected component.","summary":"Databasement up to 1.8.1 has a missing authorization check in its scheduled restore API, reached through the schema_name argument. A remote attacker can trigger scheduled restore actions without the rights they should need.","severity":"medium","cvss":5.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["databasement","laravel","package","php","self-hosted"],"not_affected_if":["default-config"],"how_to_check":"- Check the installed Databasement version; versions up to and including `1.8.1` are affected.\n- Review whether the API exposes the scheduled restore endpoint (`app/Http/Requests/Api/V1/SaveScheduledRestoreRequest.php`) to untrusted users.","fix":"- Upgrade Databasement to `1.8.2` or later.","status":"open","published_at":"2026-10-18T06:16:56+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","triaged_at":"2026-10-25T04:10:23+00:00","updated_at":"2026-10-25T04:10:23+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T04:10:23Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Databasement to `1.8.2` or later.","reach":"internet","title":"Databasement: scheduled restore API lacks authorization, letting remote callers act","impact":"medium","summary":"Databasement up to 1.8.1 has a missing authorization check in its scheduled restore API, reached through the schema_name argument. A remote attacker can trigger scheduled restore actions without the rights they should need.","category":"package","nicknames":[],"who_cares":["databasement","self-hosted","php","laravel"],"confidence":0.6,"needs_auth":"unknown","worst_case":"unauthorized callers can change scheduled database restore jobs remotely","analyst_note":"Confirm whether the API requires any authentication before the missing check and what the restore actions can overwrite, using the NVD entry or the upstream fix commit for 1.8.2.","how_to_check":"- Check the installed Databasement version; versions up to and including `1.8.1` are affected.\n- Review whether the API exposes the scheduled restore endpoint (`app/Http/Requests/Api/V1/SaveScheduledRestoreRequest.php`) to untrusted users.","needs_analyst":true,"not_affected_if":["default-config"],"who_is_affected":"Teams that self-host Databasement at version 1.8.1 or earlier and expose its API to users or networks beyond trusted administrators. Instances on `1.8.2` or later are not affected by this issue.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000605,"input_tokens":3387,"output_tokens":533,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-111875':13A,16A '-2026':12A,15A '1.8.1':27B,70C '1.8.2':120C 'act':10A 'action':51B 'address':121C 'affect':71C,130C 'api':4A,37B 'app/http/requests/api/v1/savescheduledrestorerequest.php':82C 'argument':43B,92C 'attack':46B,100C 'author':6A,31B,98C 'caller':9A 'check':32B 'compon':85C,131C 'crti':66C 'cve':11A,14A 'databas':1A,17B,24B,67C 'david':65C 'david-crti':64C 'disclos':109C 'execut':103C 'exploit':106C 'file':81C 'found':62C 'function':78C 'host':23B 'issu':123C 'lack':5A 'laravel':18B 'lead':95C 'let':7A 'manipul':89C 'may':114C 'miss':30B,97C 'name':42B,94C 'need':57B 'packag':19B 'php':20B 'public':112C 'reach':38B 'remot':8A,45B,104C 'restor':3A,36B,50B,87C 'right':54B 'schedul':2A,35B,49B,86C 'schema':41B,93C 'self':22B 'self-host':21B 'suggest':126C 'trigger':48B 'unknown':77C 'upgrad':117C,128C 'use':116C 'version':119C 'vulner':59C,74C 'without':52B","nicknames":[],"mitigations":[],"who_affected":"Teams that self-host Databasement at version 1.8.1 or earlier and expose its API to users or networks beyond trusted administrators. Instances on `1.8.2` or later are not affected by this issue.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T06:16:56+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111875","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111875","severity":null,"published_at":"2026-10-18T06:16:56+00:00","modified_at":"2026-10-19T17:17:04+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}