CVE-2026-121455
DbGate before 7.3.3 Missing Authorization via /connections/test and /connections/save
CVSS Score
5.4
EPSS Score
0.0%
EPSS Percentile
0th
DbGate before 7.3.3 contains a missing authorization vulnerability that allows connection-restricted authenticated users to bypass LOGIN_PERMISSIONS because test() and save() never call testConnectionPermission. Attackers can submit arbitrary connection definitions to POST /connections/test to probe internal database hosts, or to /connections/save to overwrite stored connections.
| CWE | CWE-862 |
| Vendor | dbgate |
| Product | dbgate |
| Published | Nov 3, 2026 |
Stay Ahead of the Next One
Get instant alerts for dbgate dbgate
Be the first to know when new medium vulnerabilities affecting dbgate dbgate are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
Low
Availability
None
Affected Versions
dbgate / dbgate
0 < 7.3.3
References
github.com: https://github.com/dbgate/dbgate/issues/1601 github.com: https://github.com/dbgate/dbgate github.com: https://github.com/dbgate/dbgate/commit/9166a987bfec github.com: https://github.com/dbgate/dbgate/blob/v7.3.2/packages/api/src/controllers/connections.js#L227-L250 github.com: https://github.com/dbgate/dbgate/blob/v7.3.2/packages/api/src/controllers/connections.js#L372-L390 vulncheck.com: https://www.vulncheck.com/advisories/dbgate-before-7.3.3-missing-authorization-via-connections-test-and-connections-save
Credits
George Chen