databasement Path Traversal and Access Control Flaws

Improper access control in David-Crty databasement up to and including 1.7.1 allows an authenticated low-privileged user to read snapshot records that belong outside their authorized organization or scope through the /api/v1/snapshots endpoint, where SnapshotPolicy.viewAny and SnapshotPolicy.view fail to enforce proper scoping. Because the CVSS vector carries PR:L, exploitation requires a valid account on a multi-user or multi-organization deployment, and the assessed impact is limited to low confidentiality with no integrity or availability effect (CVSS 4.0 base 5.3; independently assessed CVSS 3.1 5.3). Publicly available exploit code exists, and the flaw is fully addressed by upgrading to version 1.7.2, which hardens organization scoping.

Path traversal in David-Crty databasement up to 1.7.1 lets a high-privileged authenticated user escape the intended backup volume by supplying a crafted schema_name to the database-servers restore API endpoint, reaching filesystem locations outside the restore target. The attack is network-reachable but rated high-complexity and difficult to exploit, and its assessed impact is limited to low confidentiality, integrity and availability with no scope change. Publicly available exploit code exists, though there is no confirmed evidence of active exploitation; the issue is fixed in 1.7.2.