Description
A vulnerability was determined in David-Crty databasement up to 1.7.1. Affected is the function SnapshotPolicy.viewAny/SnapshotPolicy.view of the file /api/v1/snapshots of the component Snapshot Model. This manipulation causes improper access controls. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. Upgrading to version 1.7.2 is able to address this issue. The affected component should be upgraded.
Published: 2026-10-01
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Improper Access Control allowing remote exploitation
Action: Patch
AI Analysis

Impact

The vulnerability exists in the Snapshot Policy component of the David-Crty databasement in versions up through 1.7.1. It allows an attacker who can reach the /api/v1/snapshots endpoint to invoke the SnapshotPolicy.viewAny or SnapshotPolicy.view functions without proper authorization checks. This results in the ability to read snapshot data that should be restricted, effectively providing a read‑only breach of confidentiality for database state. The weakness is categorized as CWE‑266 (Improper Privilege Management) and CWE‑284 (Improper Access Control).

Affected Systems

All released versions of the David-Crty databasement product up to 1.7.1 contain the flaw, specifically the Snapshot Model API handling snapshot requests. If your deployment is using a version prior to 1.7.2, it is affected.

Risk and Exploitability

The CVSS score of 5.3 indicates moderate severity. The EPSS score is not available, so current exploitation likelihood cannot be quantified. The flaw is not listed in the CISA KEV catalog. Attackers can exploit this remotely by sending HTTP requests to the vulnerable endpoint, and if the service is exposed to the internet they can easily retrieve snapshot information. Prompt patching mitigates the risk.

Generated by OpenCVE AI on October 1, 2026 at 05:47 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade the databasement package to version 1.7.2 or newer to apply the vendor‑issued fix.
  • Configure the web application firewall or reverse proxy to enforce role‑based access control on the /api/v1/snapshots route, allowing only authenticated users with the necessary privileges to query snapshots.
  • Apply network segmentation or firewall rules to restrict access to the Snapshot API from untrusted networks, ensuring that only trusted internal hosts can reach the endpoint.

Generated by OpenCVE AI on October 1, 2026 at 05:47 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 06 Oct 2026 01:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 01 Oct 2026 03:45:00 +0000

Type Values Removed Values Added
Description A vulnerability was determined in David-Crty databasement up to 1.7.1. Affected is the function SnapshotPolicy.viewAny/SnapshotPolicy.view of the file /api/v1/snapshots of the component Snapshot Model. This manipulation causes improper access controls. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. Upgrading to version 1.7.2 is able to address this issue. The affected component should be upgraded.
Title David-Crty databasement Snapshot Model snapshots SnapshotPolicy.view access control
First Time appeared David-crty
David-crty databasement
Weaknesses CWE-266
CWE-284
CPEs cpe:2.3:a:david-crty:databasement:*:*:*:*:*:*:*:*
Vendors & Products David-crty
David-crty databasement
References
Metrics cvssV2_0

{'score': 6.5, 'vector': 'AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:OF/RC:C'}

cvssV3_0

{'score': 6.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C'}

cvssV3_1

{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

David-crty Databasement
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-10-05T23:59:43.707Z

Reserved: 2026-09-30T19:07:07.057Z

Link: CVE-2026-103534

cve-icon Vulnrichment

Updated: 2026-10-05T23:59:39.304Z

cve-icon NVD

Status : Deferred

Published: 2026-10-01T04:18:04.380

Modified: 2026-10-06T01:16:33.357

Link: CVE-2026-103534

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-01T10:45:06Z

Weaknesses
  • CWE-266

    Incorrect Privilege Assignment

  • CWE-284

    Improper Access Control