Databasement EUVD-2026-84525

Exploitation requires the attacker to possess a valid but still-pending Databasement invitation link (leaked, forwarded, or intercepted) - this is the core prerequisite, not a default-open condition. The flaw lives in the AcceptInvitation Livewire flow, which validates the token when the acceptance page first loads and caches that authorization decision without re-checking token validity at the moment of acceptance. The attacker must load the page while the invite is pending and then submit acceptance AFTER the legitimate invitee has already accepted, winning a timing race (reflected in CVSS AT:P). Limiting factors: only affects Databasement versions before 1.7.14; requires obtaining/holding a specific invitation link and precise timing; fixed by re-verifying the invitation server-side.

This is a genuine authorization/account-takeover flaw (CWE-863) but the real-world urgency is dampened by product footprint and exploitation preconditions. The vendor CVSS 4.0 vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N (9.1) correctly captures unauthenticated network reach and high confidentiality/integrity impact (account password overwrite → access to managed database credentials), and its AT:P (attack requirement) flag acknowledges the timing/race dependency described. No EPSS score, no CISA KEV listing, and no public exploit are present in the input, so this is 'no public exploit identified at time of analysis' - a patched authorization bug rather than an actively exploited threat. The score is legitimately high on technical impact but should be triaged as MODERATE real-world priority: exploitation is gated on possessing a leaked/forwarded pending invitation link AND winning a race to accept it after the legitimate user, and the affected product is an obscure single-maintainer self-hosted tool with negligible enterprise footprint. I assess AC as higher than the vendor's AC:L because reliable exploitation requires both a leaked link and precise timing; the AT:P flag partly offsets this. No conflicting signals across sources - patch, references, and description are consistent.

An attacker obtains a forwarded or leaked pending Databasement invitation link and opens the acceptance page while the invite is still valid, causing the server to cache the authorization decision. After the legitimate invitee has already accepted, the attacker submits the still-cached acceptance to overwrite the account password and log in, gaining access to the managed database credentials and secrets. No public proof-of-concept is available, and the attack requires winning a timing window (CVSS AT:P), so it is opportunistic rather than trivially automatable.