Databasus 3.7.0 through 3.61.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to brute-force password reset… (CVE-2026-110770)

Databasus versions 3.7.0 through 3.61.0 contain an authentication bypass vulnerability (CVE-2026-110770) in the password reset functionality. Attackers can send POST requests to /api/v1/users/reset-password for a known email address to request a six-digit reset code. Due to the absence of rate limiting, lockout mechanisms, or invalidation of codes, attackers can brute-force these codes to reset passwords and gain unauthorized access to user accounts, including those with administrative privileges.

Successful exploitation allows unauthenticated attackers to take over user accounts by brute-forcing password reset codes. This includes the potential compromise of administrator accounts, leading to full system compromise with high confidentiality, integrity, and availability impacts.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, monitor for suspicious password reset activity and consider implementing external mitigations such as rate limiting or multi-factor authentication if possible.