Threats affecting pkg:github/Databasement

Databasement versions prior to 1.10.9 have an authentication bypass vulnerability in the OAuthService component. The flaw occurs because the system links OpenID Connect (OIDC) identities to local user accounts by email without verifying if the email is confirmed. This allows attackers to create an identity provider account using a victim's unverified email and gain unauthorized access as that user, including super-admin accounts, bypassing password resets.

CVE-2026-108963 is a high-severity vulnerability in databasement before version 1.8.2 that allows authenticated users to perform remote code execution. The issue arises because databasement runs commands like mariadb-dump with a database name argument that can be controlled by any authenticated user. This argument injection can lead to indirect code execution, such as writing files to arbitrary locations like /app/public/index.php. The vulnerability is due to improper neutralization of argument delimiters (CWE-88).