Live › vulnerability › CVE-2026-121455
DbGate before 7.3.3 does not check connection permissions on its test and save endpoints, so a user limited to certain connections can bypass that restriction. An attacker with such an account can probe internal database hosts through the test endpoint and overwrite stored connection definitions through the save endpoint.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 16:21 UTC. All times on this page are UTC.
Teams that run DbGate as a shared web database client and use per-user connection restrictions (LOGIN_PERMISSIONS) to limit what each account can reach. The flaw only matters where some users are authenticated but restricted to specific connections; instances with a single trusted user or no connection restrictions are less exposed.
No product ranges from the sources yet.
7.3.3; anything earlier is in scope.LOGIN_PERMISSIONS restrictions in the deployment configuration and whether any users are limited to specific connections.7.3.3 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
DbGate before 7.3.3 contains a missing authorization vulnerability that allows connection-restricted authenticated users to bypass LOGIN_PERMISSIONS because test() and save() never call testConnectionPermission. Attackers can submit arbitrary connection definitions to POST /connections/test to probe internal database hosts, or to /connections/save to overwrite stored connections.
This page as .md · .json · in your agent: get_signal("CVE-2026-121455")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.