Threats tagged 'ghsa-23v4-23h4-8j67'

DbGate versions prior to 7.3.3 have a missing authorization vulnerability that allows authenticated users with connection restrictions to bypass LOGIN_PERMISSIONS. This occurs because the test() and save() functions do not call testConnectionPermission, enabling attackers to submit arbitrary connection definitions to probe internal database hosts or overwrite stored connections.