Which versions of Gorse are affected by EUVD-2026-40158?

Gorse recommendation engine before version 0.5.10 allows unauthenticated attackers to exfiltrate or overwrite the entire database when deployed with default configuration (admin_api_key unset),…. A patch is available.

Is there a public PoC exploit available for EUVD-2026-40158?

Yes, a public proof-of-concept exploit is available for EUVD-2026-40158. Prioritise patching immediately. EPSS: 0.9%.

How to fix or mitigate EUVD-2026-40158?

Within 24 hours: Inventory all Gorse deployments and verify if admin_api_key is configured in production environments. Within 7 days: For all affected instances, immediately set a strong admin_api_key value in configuration and restrict network access to /api/dump and /api/restore endpoints. Within 30 days: Monitor vendor advisories for patch availability in Gorse 0.5.10 or later; when released, upgrade and audit data access logs for unauthorized exfiltration.

Gorse EUVD-2026-40158

Q: What is the CVSS score of EUVD-2026-40158?

EUVD-2026-40158 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.9%.

| CVE-2026-56782 CRITICAL

Missing Authentication for Critical Function (CWE-306)

2026-06-29 disclosure@vulncheck.com

GHSA-65p2-39gr-3m25

Authentication Bypass

9.3

CVSS 4.0 · Vendor: vulncheck

Severity by source

Vendor (vulncheck) PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.8 CRITICAL

Network-reachable endpoint with default empty key gives AV:N/AC:L/PR:N/UI:N; /api/dump exposes all data (C:H) while /api/restore overwrites the dataset (I:H, A:H).

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (vulncheck).

CVSS VectorVendor: vulncheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jun 29, 2026 - 19:01 EUVD

Analysis Generated

Jun 29, 2026 - 18:32 vuln.today

DescriptionCVE.org

Gorse before 0.5.10 contains an authentication bypass vulnerability in the /api/dump and /api/restore endpoints that allows unauthenticated attackers to access protected functionality when admin_api_key is empty, which is the default configuration. Remote attackers can exfiltrate the entire database including user records, items, and feedback data containing personally identifiable information, or completely overwrite the dataset without authentication.

AnalysisAI

Unauthenticated database exfiltration and overwrite in Gorse (the open-source Go recommendation engine) before 0.5.10 lets remote attackers hit the /api/dump and /api/restore endpoints whenever admin_api_key is unset - the out-of-the-box default - bypassing authentication entirely. Attackers can dump the full backing dataset (user records, items, and feedback containing PII) or restore/overwrite it with arbitrary data. No public exploit is identified at time of analysis, but the flaw is trivially reachable on any default deployment, and the vendor (VulnCheck) rates it CVSS 4.0 9.3 (critical).

Technical ContextAI

Gorse is a self-hosted recommender-system service written in Go that exposes an HTTP/REST API for ingesting users, items, and feedback and serving recommendations. The vulnerability is a CWE-306 (Missing Authentication for Critical Function): the /api/dump (full dataset export) and /api/restore (full dataset import/overwrite) administrative endpoints are gated by a comparison against the admin_api_key configuration value, but when that value is empty the key check is effectively skipped rather than failing closed. Because admin_api_key ships empty by default, the protected functionality is open to anyone who can reach the API port. The fix lands in upstream commit 19fdcbb (PR #1293, tracking issue #1292) and is released in version 0.5.10.

RemediationAI

Vendor-released patch: upgrade to Gorse 0.5.10 or later, which corrects the empty-key authentication bypass on /api/dump and /api/restore (PR #1293, commit 19fdcbb). If immediate upgrade is not possible, the primary compensating control is to configure a strong, non-empty admin_api_key so the endpoint authentication actually enforces - this is the root trigger and closes the default-config exposure with minimal side effects. Additionally, restrict network access to the Gorse API port so the /api/dump and /api/restore endpoints are not reachable from untrusted networks (e.g. bind to localhost, place behind an authenticated reverse proxy, or firewall the port), accepting that this requires legitimate API clients to route through the allowed path. See the VulnCheck advisory (https://www.vulncheck.com/advisories/gorse-unauthenticated-database-dump-and-restore-via-api-dump-and-api-restore-endpoints) for details.