---
id: "CVE-2026-111875"
kind: "vulnerability"
aliases: ["CVE-2026-111875"]
title: "Databasement: scheduled restore API lacks authorization, letting remote callers act"
severity: "medium"
cvss: 5.8
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["databasement", "laravel", "package", "php", "self-hosted"]
not_affected_if: ["default-config"]
published_at: "2026-10-18T06:16:56+00:00"
first_seen_at: "2026-10-23T21:57:14+00:00"
updated_at: "2026-10-25T04:10:23+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111875", "first_seen_at": "2026-10-23T21:57:14+00:00"}]
---

# Databasement: scheduled restore API lacks authorization, letting remote callers act

Databasement up to 1.8.1 has a missing authorization check in its scheduled restore API, reached through the schema_name argument. A remote attacker can trigger scheduled restore actions without the rights they should need.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Databasement version; versions up to and including `1.8.1` are affected.
- Review whether the API exposes the scheduled restore endpoint (`app/Http/Requests/Api/V1/SaveScheduledRestoreRequest.php`) to untrusted users.

## Fix

- Upgrade Databasement to `1.8.2` or later.

## Timeline

- 2026-10-23T21:57:14+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-111875

## From the sources

A vulnerability has been found in David-Crty Databasement up to 1.8.1. Affected by this vulnerability is an unknown functionality of the file app/Http/Requests/Api/V1/SaveScheduledRestoreRequest.php of the component Scheduled Restore. Such manipulation of the argument schema_name leads to missing authorization. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.8.2 addresses this issue. It is suggested to upgrade the affected component.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_