{"id":"CVE-2026-121455","kind":"vulnerability","aliases":["CVE-2026-121455"],"related":[],"title":"DbGate: connection-restricted users can probe hosts and overwrite saved connections","description":"DbGate before 7.3.3 contains a missing authorization vulnerability that allows connection-restricted authenticated users to bypass LOGIN_PERMISSIONS because test() and save() never call testConnectionPermission. Attackers can submit arbitrary connection definitions to POST /connections/test to probe internal database hosts, or to /connections/save to overwrite stored connections.","summary":"DbGate before 7.3.3 does not check connection permissions on its test and save endpoints, so a user limited to certain connections can bypass that restriction. An attacker with such an account can probe internal database hosts through the test endpoint and overwrite stored connection definitions through the save endpoint.","severity":"medium","cvss":5.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["databases","dbgate","package","self-hosted"],"not_affected_if":["no-connection-restrictions","single-user-instance"],"how_to_check":"- Check the installed DbGate version against `7.3.3`; anything earlier is in scope.\n- Look for `LOGIN_PERMISSIONS` restrictions in the deployment configuration and whether any users are limited to specific connections.\n- Review who holds accounts on the DbGate instance.","fix":"- Move to `7.3.3` or later.","status":"open","published_at":"2026-11-03T16:17:24+00:00","first_seen_at":"2026-11-03T16:21:43+00:00","triaged_at":"2026-11-03T16:24:16+00:00","updated_at":"2026-11-03T16:24:16+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-03T16:24:16Z","model":"claude-haiku-5-5","output":{"fix":"- Move to `7.3.3` or later.","reach":"network","title":"DbGate: connection-restricted users can probe hosts and overwrite saved connections","impact":"medium","summary":"DbGate before 7.3.3 does not check connection permissions on its test and save endpoints, so a user limited to certain connections can bypass that restriction. An attacker with such an account can probe internal database hosts through the test endpoint and overwrite stored connection definitions through the save endpoint.","audience":"businesses","category":"package","nicknames":[],"who_cares":["dbgate","self-hosted","databases"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"Restricted user reaches internal database hosts and overwrites stored connections","analyst_note":"","how_to_check":"- Check the installed DbGate version against `7.3.3`; anything earlier is in scope.\n- Look for `LOGIN_PERMISSIONS` restrictions in the deployment configuration and whether any users are limited to specific connections.\n- Review who holds accounts on the DbGate instance.","plain_action":"","needs_analyst":false,"not_affected_if":["single-user-instance","no-connection-restrictions"],"who_is_affected":"Teams that run DbGate as a shared web database client and use per-user connection restrictions (LOGIN_PERMISSIONS) to limit what each account can reach. The flaw only matters where some users are authenticated but restricted to specific connections; instances with a single trusted user or no connection restrictions are less exposed.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000702,"input_tokens":4187,"output_tokens":567,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-121455':15A,18A '-2026':14A,17A '/connections/save':116C '/connections/test':108C '7.3.3':27B,76C 'account':55B 'allow':83C 'arbitrari':103C 'attack':51B,100C 'authent':87C 'author':80C 'bypass':47B,90C 'call':98C 'certain':44B 'check':30B 'connect':3A,12A,31B,45B,68B,85C,104C,120C 'connection-restrict':2A,84C 'contain':77C 'cve':13A,16A 'databas':19B,59B,112C 'dbgate':1A,20B,25B,74C 'definit':69B,105C 'endpoint':38B,64B,73B 'host':8A,24B,60B,113C 'intern':58B,111C 'limit':42B 'login':91C 'miss':79C 'never':97C 'overwrit':10A,66B,118C 'packag':21B 'permiss':32B,92C 'post':107C 'probe':7A,57B,110C 'restrict':4A,49B,86C 'save':11A,37B,72B,96C 'self':23B 'self-host':22B 'store':67B,119C 'submit':102C 'test':35B,63B,94C 'testconnectionpermiss':99C 'user':5A,41B,88C 'vulner':81C","nicknames":[],"mitigations":[],"who_affected":"Teams that run DbGate as a shared web database client and use per-user connection restrictions (LOGIN_PERMISSIONS) to limit what each account can reach. The flaw only matters where some users are authenticated but restricted to specific connections; instances with a single trusted user or no connection restrictions are less exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["databases","dbgate","medium","package","selfhosted"],"campaign_type":null,"first_public_at":"2026-11-03T16:17:24+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121455","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121455","severity":null,"published_at":"2026-11-03T16:17:24+00:00","modified_at":"2026-11-03T16:17:24+00:00","first_seen_at":"2026-11-03T16:21:43+00:00","fetched_at":"2026-11-03T16:21:43+00:00","note":null}],"documents":[{"id":58819,"url":"https://github.com/dbgate/dbgate/commit/9166a987bfec","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":58820,"url":"https://www.vulncheck.com/advisories/dbgate-before-7.3.3-missing-authorization-via-connections-test-and-connections-save","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}