The vulnerability is a missing authorization check on Dgraph's restoreTenant mutation. An unauthenticated attacker can provide arbitrary backup source URLs—including local file paths—as well as credentials for cloud storage or Vault. Because the mutation runs without any authentication, the attacker can overwrite the entire database, read server‑side files, and trigger server‑side request forgery, thereby gaining full control of the database, accessing sensitive files, or executing arbitrary code on the host. The flaw is a missing authorization enforcement (CWE‑862) that permits privileged actions to be taken by anyone.

Dgraph, an open‑source distributed GraphQL database, is affected. Versions prior to 25.3.1 lack the necessary authorization check on the restoreTenant endpoint. Users running any of these versions are vulnerable until they upgrade to the fixed release 25.3.1 or later.

The CVSS score is 10, indicating a critical severity. The EPSS score is not available, but the vulnerability allows exploitation over the network without authentication, making the attack vector essentially a public-facing API call to restoreTenant. While the vulnerability is not listed in the CISA KEV catalog, it provides a direct route to database compromise and potential server‑side code execution. An attacker can exploit it by sending a crafted GraphQL mutation with a malicious backup source URL, and no administrative credentials are required.