Description
A vulnerability has been found in David-Crty Databasement up to 1.8.1. Affected by this vulnerability is an unknown functionality of the file app/Http/Requests/Api/V1/SaveScheduledRestoreRequest.php of the component Scheduled Restore. Such manipulation of the argument schema_name leads to missing authorization. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.8.2 addresses this issue. It is suggested to upgrade the affected component.
Published: 2026-10-18
Score: 5.1 Medium
EPSS: n/a
KEV: No
Impact: Authorization Bypass via schema_name Manipulation
Action: Upgrade Immediately
AI Analysis

Impact

A bug in the Scheduled Restore feature of David-Crty Databasement allows an attacker to alter the schema_name parameter in the SaveScheduledRestoreRequest.php endpoint, causing the application to skip its authorization check. This flaw can be triggered remotely by crafting a request that specifies a schema name the user is not permitted to access, enabling unauthorized use of privileged scheduled restore functionality.

Affected Systems

The vulnerability affects all versions of David-Crty Databasement up to and including 1.8.1. Versions starting with 1.8.2 contain the fix and are not impacted.

Risk and Exploitability

The CVSS score of 5.1 indicates a medium severity flaw. Because an EPSS score is not available, a precise exploit likelihood cannot be quantified. The vulnerability is not listed in the CISA KEV catalogue. The only documented attack vector is remote input manipulation of the schema_name argument, which allows a malicious actor to bypass authorization checks and perform privileged scheduled restore operations.

Generated by OpenCVE AI on October 18, 2026 at 06:50 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Databasement to version 1.8.2 or later
  • If upgrading immediately is not possible, temporarily disable the Scheduled Restore feature or block access to the SaveScheduledRestoreRequest endpoint until the patch is applied
  • Apply strict role‑based access control to the scheduled restore API to ensure only authorized users can invoke the operation

Generated by OpenCVE AI on October 18, 2026 at 06:50 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sun, 18 Oct 2026 05:45:00 +0000

Type Values Removed Values Added
Description A vulnerability has been found in David-Crty Databasement up to 1.8.1. Affected by this vulnerability is an unknown functionality of the file app/Http/Requests/Api/V1/SaveScheduledRestoreRequest.php of the component Scheduled Restore. Such manipulation of the argument schema_name leads to missing authorization. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.8.2 addresses this issue. It is suggested to upgrade the affected component.
Title David-Crty Databasement Scheduled Restore SaveScheduledRestoreRequest.php authorization
First Time appeared David-crty
David-crty databasement
Weaknesses CWE-862
CWE-863
CPEs cpe:2.3:a:david-crty:databasement:*:*:*:*:*:*:*:*
Vendors & Products David-crty
David-crty databasement
References
Metrics cvssV2_0

{'score': 5.8, 'vector': 'AV:N/AC:L/Au:M/C:P/I:P/A:P/E:POC/RL:OF/RC:C'}

cvssV3_0

{'score': 4.7, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C'}

cvssV3_1

{'score': 4.7, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C'}

cvssV4_0

{'score': 5.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

David-crty Databasement
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-10-18T05:30:17.829Z

Reserved: 2026-10-17T09:48:37.852Z

Link: CVE-2026-111875

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Deferred

Published: 2026-10-18T06:16:56.840

Modified: 2026-10-18T06:16:57.003

Link: CVE-2026-111875

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-18T07:00:10Z

Weaknesses