CVE-2026-103534

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-103534", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2026-09-30T19:07:07.057Z", "datePublished": "2026-10-01T03:30:12.027Z", "dateUpdated": "2026-10-05T23:59:43.707Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-10-01T03:30:12.027Z"}, "title": "David-Crty databasement Snapshot Model snapshots SnapshotPolicy.view access control", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-284", "lang": "en", "description": "Improper Access Controls"}]}, {"descriptions": [{"type": "CWE", "cweId": "CWE-266", "lang": "en", "description": "Incorrect Privilege Assignment"}]}], "affected": [{"vendor": "David-Crty", "product": "databasement", "versions": [{"version": "1.7.0", "status": "affected"}, {"version": "1.7.1", "status": "affected"}, {"version": "1.7.2", "status": "unaffected"}], "cpes": ["cpe:2.3:a:david-crty:databasement:*:*:*:*:*:*:*:*"], "modules": ["Snapshot Model"]}], "descriptions": [{"lang": "en", "value": "A vulnerability was determined in David-Crty databasement up to 1.7.1. Affected is the function SnapshotPolicy.viewAny/SnapshotPolicy.view of the file /api/v1/snapshots of the component Snapshot Model. This manipulation causes improper access controls. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. Upgrading to version 1.7.2 is able to address this issue. The affected component should be upgraded."}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.3, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P", "baseSeverity": "MEDIUM"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 6.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C", "baseSeverity": "MEDIUM"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 6.3, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C", "baseSeverity": "MEDIUM"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 6.5, "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:OF/RC:C"}}], "timeline": [{"time": "2026-09-30T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2026-09-30T02:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2026-09-30T21:12:15.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "ByteJMP (VulDB User)", "type": "reporter"}], "references": [{"url": "https://vuldb.com/vuln/412346", "name": "VDB-412346 | David-Crty databasement Snapshot Model snapshots SnapshotPolicy.view access control", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/412346/cti", "name": "VDB-412346 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/cve/CVE-2026-103534", "name": "CVE-2026-103534 | CVE Analysis and Report", "tags": ["third-party-advisory"]}, {"url": "https://vuldb.com/submit/957818", "name": "Submit #957818 | David-Crty Databasement >= 1.2.0, < 1.7.2 Improper Access Controls", "tags": ["third-party-advisory"]}, {"url": "https://github.com/David-Crty/databasement/security/advisories/GHSA-vx6q-v2gv-5fhv", "tags": ["exploit"]}, {"url": "https://github.com/David-Crty/databasement/releases/tag/v1.7.2", "tags": ["patch"]}, {"url": "https://github.com/David-Crty/databasement/", "tags": ["product"]}], "x_generator": ["VulDB PVTS v202610"]}, "adp": [{"references": [{"url": "https://github.com/David-Crty/databasement/security/advisories/GHSA-vx6q-v2gv-5fhv", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-10-05T23:59:19.668271Z", "id": "CVE-2026-103534", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-05T23:59:43.707Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-103534", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-05T23:59:19.668271Z"}}}], "references": [{"url": "https://github.com/David-Crty/databasement/security/advisories/GHSA-vx6q-v2gv-5fhv", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-05T23:59:39.304Z"}}], "cna": {"title": "David-Crty databasement Snapshot Model snapshots SnapshotPolicy.view access control", "credits": [{"lang": "en", "type": "reporter", "value": "ByteJMP (VulDB User)"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 6.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 6.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 6.5, "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:OF/RC:C"}}], "affected": [{"cpes": ["cpe:2.3:a:david-crty:databasement:*:*:*:*:*:*:*:*"], "vendor": "David-Crty", "modules": ["Snapshot Model"], "product": "databasement", "versions": [{"status": "affected", "version": "1.7.0"}, {"status": "affected", "version": "1.7.1"}, {"status": "unaffected", "version": "1.7.2"}]}], "timeline": [{"lang": "en", "time": "2026-09-30T00:00:00.000Z", "value": "Advisory disclosed"}, {"lang": "en", "time": "2026-09-30T02:00:00.000Z", "value": "VulDB entry created"}, {"lang": "en", "time": "2026-09-30T21:12:15.000Z", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/vuln/412346", "name": "VDB-412346 | David-Crty databasement Snapshot Model snapshots SnapshotPolicy.view access control", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/412346/cti", "name": "VDB-412346 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/cve/CVE-2026-103534", "name": "CVE-2026-103534 | CVE Analysis and Report", "tags": ["third-party-advisory"]}, {"url": "https://vuldb.com/submit/957818", "name": "Submit #957818 | David-Crty Databasement >= 1.2.0, < 1.7.2 Improper Access Controls", "tags": ["third-party-advisory"]}, {"url": "https://github.com/David-Crty/databasement/security/advisories/GHSA-vx6q-v2gv-5fhv", "tags": ["exploit"]}, {"url": "https://github.com/David-Crty/databasement/releases/tag/v1.7.2", "tags": ["patch"]}, {"url": "https://github.com/David-Crty/databasement/", "tags": ["product"]}], "x_generator": ["VulDB PVTS v202610"], "descriptions": [{"lang": "en", "value": "A vulnerability was determined in David-Crty databasement up to 1.7.1. Affected is the function SnapshotPolicy.viewAny/SnapshotPolicy.view of the file /api/v1/snapshots of the component Snapshot Model. This manipulation causes improper access controls. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. Upgrading to version 1.7.2 is able to address this issue. The affected component should be upgraded."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-284", "description": "Improper Access Controls"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-266", "description": "Incorrect Privilege Assignment"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-10-01T03:30:12.027Z"}}}, "cveMetadata": {"cveId": "CVE-2026-103534", "state": "PUBLISHED", "dateUpdated": "2026-10-05T23:59:43.707Z", "dateReserved": "2026-09-30T19:07:07.057Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2026-10-01T03:30:12.027Z", "assignerShortName": "VulDB"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:a:david-crty:databasement:*:*:*:*:*:*:*:*"], "modules": ["Snapshot Model"], "product": "databasement", "vendor": "David-Crty", "versions": [{"status": "affected", "version": "1.7.0"}, {"status": "affected", "version": "1.7.1"}, {"status": "unaffected", "version": "1.7.2"}]}], "source": "cna@vuldb.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability was determined in David-Crty databasement up to 1.7.1. Affected is the function SnapshotPolicy.viewAny/SnapshotPolicy.view of the file /api/v1/snapshots of the component Snapshot Model. This manipulation causes improper access controls. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. Upgrading to version 1.7.2 is able to address this issue. The affected component should be upgraded."}], "id": "CVE-2026-103534", "lastModified": "2026-10-06T01:16:33.357", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "PARTIAL", "baseScore": 6.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 8.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 6.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.4, "source": "cna@vuldb.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 2.1, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "PROOF_OF_CONCEPT", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@vuldb.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-103534", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-10-05T23:59:19.668271Z", "version": "2.0.3"}}]}, "published": "2026-10-01T04:18:04.380", "references": [{"source": "cna@vuldb.com", "url": "https://github.com/David-Crty/databasement/"}, {"source": "cna@vuldb.com", "url": "https://github.com/David-Crty/databasement/releases/tag/v1.7.2"}, {"source": "cna@vuldb.com", "url": "https://github.com/David-Crty/databasement/security/advisories/GHSA-vx6q-v2gv-5fhv"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/cve/CVE-2026-103534"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/submit/957818"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/412346"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/412346/cti"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/David-Crty/databasement/security/advisories/GHSA-vx6q-v2gv-5fhv"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-266"}, {"lang": "en", "value": "CWE-284"}], "source": "cna@vuldb.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "1.7.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "1.7.1"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "1.7.2"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "databasement", "source": "cna", "vendor": "David-Crty"}, "product": "databasement", "vendor": "david-crty"}], "created": "2026-10-01T06:00:13.924522+00:00", "updated": "2026-10-01T10:45:06.979007+00:00", "vendors": ["david-crty", "david-crty$PRODUCT$databasement"]}