Part-DB CVE-2026-86055

Exploitation requires the target instance to have email-based password reset enabled (ALLOW_EMAIL_PW_RESET=1, which the vendor describes as the expected setup when a mail server is configured) AND the default empty TRUSTED_HOSTS configuration, which causes Symfony to trust any client-supplied Host header. The attacker must know the victim's username or email (the forgot-password form accepts either) and have network access to the public /pw_reset/request endpoint; no account, CSRF secret, or trusted-proxy bypass is needed because the plain Host path is unprotected (the X-Forwarded-Host variant is already neutralised by the default TRUSTED_PROXIES=127.0.0.1). The decisive LIMITING factor is that the token only reaches the attacker if the victim opens the legitimate-looking reset email or an automated inbound URL scanner pre-fetches the link; instances that set a non-empty TRUSTED_HOSTS allowlist (reject non-matching Host with HTTP 400) or have email reset disabled are not exploitable.

This is a genuine high-priority issue, not an inflated-CVSS artifact. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H, base 8.7) aligns with the mechanism described: an unauthenticated, network-reachable host-header poisoning flaw (CWE-640) that yields full pre-authentication account takeover, including the seeded admin account. The GHSA advisory includes a complete, observed end-to-end reproduction against the official jbtronics/part-db1:v2.13.1 image, so exploit tradecraft is public and reliable. The one limiting signal is UI:P - the victim (or an automated inbound mail-security URL scanner) must dereference the emailed link - which is why this is a one-step-removed token-disclosure chain rather than a direct single-request RCE. EPSS is not provided in the input and the CVE is NOT in CISA KEV, so there is no evidence of active in-the-wild exploitation; the vuln.today decision label is 'this_week', consistent with a serious-but-not-emergency, patch-this-week posture. No signals conflict: the network vector, unauthenticated privilege, and the published working PoC all point the same direction. The main caveat is exposure scope - the flaw only matters on instances with email-based password reset enabled (ALLOW_EMAIL_PW_RESET=1) and with the default empty TRUSTED_HOSTS.

An unauthenticated attacker sends a raw POST to the public /pw_reset/request endpoint for a known account (e.g. the seeded 'admin') with a spoofed Host header; Part-DB, trusting all hosts by default, emails the victim a genuine reset token inside a link pointing at the attacker's hostname. When the victim or an automated inbound mail-security link scanner dereferences that URL, the valid token reaches the attacker, who replays it against the real instance to set a new password and seize the account. A full working proof-of-concept with observed successful takeover is published in the GHSA advisory.