CVE-2026-121455

DbGate before 7.3.3 Missing Authorization via /connections/test and /connections/save

5.3 Medium

DbGate before 7.3.3 contains a missing authorization vulnerability that allows connection-restricted authenticated users to bypass LOGIN_PERMISSIONS because test() and save() never call testConnectionPermission. Attackers can submit arbitrary connection definitions to POST /connections/test to probe internal database hosts, or to /connections/save to overwrite stored connections.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: Low
Integrity: Low
Availability: None

Exploit likelihood

0.25%Unchanged since Nov 4, 2026

What each source reports

CVE List Score used 5.3

DbGate before 7.3.3 Missing Authorization via /connections/test and /connections/save

Record: CVE-2026-121455
CVSS 4.0: 5.3 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:N/SA:N
CVSS 3.1: 5.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Weakness: CWE-862
Updated: 2026-11-03

EUVDEUVD-2026-115887 5.3

Record: EUVD-2026-115887
CVSS 4.0: 5.3 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:N/SA:N
Updated: 2026-11-03

GitHub AdvisoriesGHSA-23v4-23h4-8j67 5.3

DbGate before 7.3.3 contains a missing authorization vulnerability that allows connection...

Record: GHSA-23v4-23h4-8j67
CVSS 4.0: 5.3 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1: 5.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Weakness: CWE-862
Updated: 2026-11-03

NVD 5.3

Record: CVE-2026-121455
CVSS 4.0: 5.3 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1: 5.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Weakness: CWE-862
Updated: 2026-11-03

OSV 5.3

DbGate before 7.3.3 Missing Authorization via /connections/test and /connections/save

Record: CVE-2026-121455
CVSS 4.0: 5.3 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:N/SA:N
Weakness: CWE-862
Updated: 2026-11-05

Affected products

dbgate

History

History
Recorded	Changed	Sources
Nov 4, 2026	references	OSV
Nov 3, 2026	published	EUVD
Nov 3, 2026	published	EUVD
Nov 3, 2026	aliases, references	GitHub Advisories, NVD
Nov 3, 2026	cwes, facts, products, references, severity, title	CVE List
Nov 3, 2026	first indexed	EUVD

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-121455 is a medium vulnerability (CVSS 5.3) in Dbgate, published November 3, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.25%, the 16th percentile. No source names a fixed version.