Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-111875: David-Crty Databasement allows unauthorized scheduled restore

CVE-2026-111875 · published today

Summary

The web application David-Crty Databasement (versions up to 1.8.1) fails to check a user’s permission when processing a scheduled restore request. An attacker could trigger a restore operation without proper rights, potentially exposing or altering data. Updating the software to version 1.8.2 resolves the issue, so apply the upgrade as soon as possible.

Original advisory text

David-Crty Databasement Scheduled Restore SaveScheduledRestoreRequest.php authorization

A vulnerability has been found in David-Crty Databasement up to 1.8.1. Affected by this vulnerability is an unknown functionality of the file app/Http/Requests/Api/V1/SaveScheduledRestoreRequest.php of the component Scheduled Restore. Such manipulation of the argument schema_name leads to missing authorization. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.8.2 addresses this issue. It is suggested to upgrade the affected component.

References

https://github.com/David-Crty/databasement/ URL
https://github.com/David-Crty/databasement/releases/tag/v1.8.2 Patch
https://github.com/David-Crty/databasement/security/advisories/GHSA-3rjj-69wh-r9... Exploit
https://vuldb.com/cve/CVE-2026-111875 Vendor Advisory
https://vuldb.com/submit/1005220 Vendor Advisory
https://vuldb.com/vuln/421587 Vendor Advisory
https://vuldb.com/vuln/421587/cti Third Party Advisory
https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/111xxx/CVE-2026-1118... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-111875 Vendor Advisory

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit (estimated)
Gives an attacker partial control (estimated)

Severity

7.9 High

Exploitation

<1% chance of attack within 30 days

Type

CWE-862Missing Authorization

CWE-863Incorrect Authorization

Timeline

Published18 Oct 2026

Updated19 Oct 2026

First seen18 Oct 2026

Sources

CVE-2026-111875 · NVD

CVE-2026-111875 · OSV

GHSA-3rjj-69wh-r95f · GHSA

Track software like this

Free during beta