Databasement CVE-2026-111875

Exploitation requires an authenticated account on the Databasement instance (CVSS PR:H/PR:L - no unauthenticated path) and that the Scheduled Restore feature is in use; the attacker manipulates the schema_name argument in a SaveScheduledRestoreRequest API call to reach a schema outside their authorization. No user interaction is needed (UI:N) and no special non-default configuration beyond having the restore feature available. The primary limiting factor is the required valid, privileged session - this is not remote-unauthenticated - which, combined with LOW impact and the product's tiny deployment base, constrains realistic risk despite the public PoC.

This is a medium-severity, authorization flaw (CWE-862 Missing Authorization) in the Scheduled Restore component of Databasement, exploitable remotely over the network per the CVSS 4.0 vector (AV:N/AC:L). The vendor vector sets PR:H, meaning exploitation requires an authenticated and privileged account, which substantially limits the attacker population and keeps the base score modest at 5.1. Impact is uniformly LOW across confidentiality, integrity and availability (VC:L/VI:L/VA:L) with no scope change, so this is not a full-compromise bug. A public exploit exists (POC=YES, via the project's own GHSA advisory) and the 4.0 vector carries E:P (proof-of-concept exploit maturity), but there is NO CISA KEV listing and NO EPSS score provided, so there is no evidence of active or widespread exploitation - this should be read as publicly disclosed, not weaponized in the wild. Note a tension worth verifying: CWE-862 Missing Authorization typically describes a low-privileged user reaching resources above their permission level, which argues for PR:L rather than the vendor's PR:H - if PR:L is correct the real-world attacker bar is lower than the 5.1 score implies. Overall this is a legitimate but non-urgent fix-on-patch-cycle item for the small population running Databasement, not a high-priority emergency.

An authenticated user of a Databasement instance submits a crafted Scheduled Restore request to app/Http/Requests/Api/V1/SaveScheduledRestoreRequest.php, manipulating the schema_name argument to reference a database schema they should not be authorized to touch. Because the authorization check is missing, the restore is scheduled against the unauthorized target, allowing limited cross-tenant/cross-schema access or modification. A public exploit and advisory (GHSA-3rjj-69wh-r95f) exist, lowering the effort to reproduce.