databasus CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

CRITICAL databasus CVE published 2026-10-14

CVE-2026-110770

CVE-2026-110770 is a critical vulnerability in Databasus versions 3.7.0 through 3.61.0, allowing unauthenticated attackers to brute-force password reset codes via the POST /api/v1/users/reset-password endpoint. This authentication bypass vulnerability enables attackers to take over accounts, including administrator accounts, without rate limiting, lockout, or invalidation of the six-digit reset codes.