EUVD-2026-96984
GHSA-vqw4-fq22-hj9c
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as allowlisted viewer (PR:L)
-
ExploitSend query/node ID to /nornicdb/search or /similar
-
ExecutionMissing authorization check bypassed
-
ImpactExfiltrate node IDs, labels and full property maps
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an authenticated NornicDB account with the viewer role that is allowlisted for the target database but denied read permission - the exact scenario the missing authorization check fails to enforce on /nornicdb/search and /nornicdb/similar. The attacker must be able to reach these HTTP endpoints over the network. Limiting factors: valid authenticated credentials are needed (PR:L, not unauthenticated), and the deployment must actually use per-database read restrictions with allowlisting - instances without such granular access policies, or where the viewer already has read, have nothing to bypass. Impact is confined to reading data (node IDs, labels, full property maps); no write or availability impact. |
| Impact | This is a confidentiality-only information-disclosure flaw rated CVSS 4.0 7.1 (HIGH). The provided 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H) shows network reachability and low attack complexity, but PR:L means exploitation requires an authenticated account - specifically a viewer-role user already allowlisted for the target database - so this is NOT a remote-unauthenticated issue. Impact is limited to confidentiality (VI:N/VA:N): no data modification or denial of service. No EPSS score, no CISA KEV listing, no SSVC decision data, and no public exploit code were supplied in the input; per precision rules this is 'no public exploit identified at time of analysis.' Weighing the signals together: the network vector and low complexity inflate the raw score, but the authentication requirement plus a confidentiality-only impact, combined with the obscure product footprint, make this a bounded, moderate-priority issue rather than a mass-exploitation threat. Treat it as a privilege-boundary/data-segregation bug relevant only to organizations actually running NornicDB with per-database read restrictions. |
| Exploit ScenarioDerived | An attacker holding a legitimate low-privilege viewer account - allowlisted for a database but explicitly denied read - issues a crafted vector search query or a node ID to the /nornicdb/search or /nornicdb/similar endpoint. Because the endpoints skip the per-database read authorization check, the server returns node IDs, labels, and full property maps the user was never authorized to see. No public exploit code was identified in the input, though a technical writeup and vulnerable source-code lines are referenced. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 11, 2026
NornicDB through 1.4.1 fails to enforce per-database read restrictions on its vector-search endpoints, so an authenticated viewer-role user who is allowlisted for a database but explicitly denied read permission can still submit search queries or node IDs to /nornicdb/search and /nornicdb/similar and retrieve node IDs, labels and full property maps. The flaw is rated CVSS 4.0 7.1 (HIGH) and is confidentiality-only (CWE-862 missing authorization), requiring valid credentials (PR:L) plus a deployment that actually uses per-database allowlisting with read denial - instances without granular policies have nothing to bypass. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (CISA KEV).
RemediationAI
No vendor-released patch has been identified at time of analysis for CVE-2026-108710, which affects NornicDB through 1.4.1; track the upstream repository (https://github.com/orneryd/NornicDB) and the VulnCheck advisory (https://www.vulncheck.com/advisories/nornicdb-through-1.4.1-missing-authorization-via-vector-search-endpoints) for a fixed version and apply it as soon as one is published. Until then, the most direct compensating control is to block the /nornicdb/search and /nornicdb/similar paths at the reverse proxy, API gateway or ingress so they are unreachable from untrusted networks - the trade-off is that all vector-similarity search functionality stops working for every user, including those legitimately authorized. A second control is to remove the risky role combination: revoke viewer role from any account that is allowlisted for a database but denied read, or remove those accounts from the allowlist entirely, so the missing check has nothing to bypass - the trade-off is reduced access for users who genuinely need allowlist membership, and it does not protect against future misconfiguration. If the API must remain reachable, restrict it to trusted network segments, require strong authentication and monitor or audit access logs for queries to the two endpoints by accounts without read permission; note that neither network restriction nor logging fixes the underlying authorization gap and both can be evaded by an attacker who already holds a valid low-privilege account on an exposed instance.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Root cause is CWE-862 Missing Authorization in the HTTP handler layer of NornicDB, the graph/vector database published by orneryd. The affected endpoints are the vector similarity search paths /nornicdb/search and /nornicdb/similar, implemented in pkg/server/server_nornicdb.go (roughly lines 415-419 and 811-815) and pkg/server/server_graph.go (roughly lines 418-423); these handlers verify that a caller is authenticated and attached to the database allowlist but omit the per-database read authorization check that guards other read paths, creating an inconsistent access-control policy between endpoint families. Because the endpoints accept free-form search queries and node IDs and return node IDs, labels and full property maps, the missing check converts a legitimate denial of read into a full metadata/property disclosure for the target database. The CPE cpe:2.3:a:orneryd:nornicdb:*:*:*:*:*:*:*:* with a wildcard version marks the whole product line up to 1.4.1 as affected. CVSS 4.0 vector AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N aligns with the independent CVSS 3.1 assessment AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N: remote, low complexity, low privileges, no user interaction, high confidentiality impact with no integrity or availability impact.
Know when Nornicdb gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Network-reachable endpoint with low complexity but requires an authenticated viewer account (PR:L); impact is full read of restricted node data (C:H) with no integrity or availability effect and no scope change.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
NornicDB through 1.4.1 contains a missing authorization vulnerability that allows authenticated users to bypass per-database read restrictions on the /nornicdb/search and /nornicdb/similar endpoints. Viewer-role users allowlisted for a database but denied read can submit search queries or node IDs to retrieve node IDs, labels and full property maps.
Executive ViewAI
NornicDB deployments through version 1.4.1 do not enforce per-database read restrictions on their vector-search endpoints, allowing an authenticated viewer-role user who is explicitly denied read access to a database to still retrieve node IDs, labels, and full property maps from it. This is a confidentiality exposure limited to organizations running granular per-database allowlisting with read denial; instances without such policies are unaffected, and no public exploit code or active exploitation has been identified. Leadership should care because the flaw could expose sensitive records to internal users who were deliberately denied access, potentially undermining data-governance and least-privilege commitments, though exploitation requires valid credentials and a specific configuration state.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict or block the /nornicdb/search and /nornicdb/similar endpoints at a reverse proxy or API gateway for viewer-role users; remove allowlist entries that conflict with explicit read denial; eliminate viewer-role accounts that do not require search access; monitor and alert on vector-search calls made by viewer-role users against restricted databases.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB