CVE-2026-110770

{
  "etk_id": "ETK-2026-1601",
  "cve_id": "CVE-2026-110770",
  "display_id": "CVE-2026-110770",
  "ghsa_id": "GHSA-jj5w-98p7-g6gj",
  "euvd_id": "EUVD-2026-101570",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Password-reset brute-force bypass in Databasus",
  "summary": "Databasus 3.7.0 through 3.61.0 allows unauthenticated password-reset code guessing for accounts with known email addresses. An attacker may take over affected accounts, including administrator accounts, where reset attempts are not limited and codes are not invalidated.",
  "mitigation": "Restrict public access to the password-reset endpoint and add rate limiting, lockout controls, and one-time code invalidation. Upgrade to a vendor-fixed release when one is published; no fixed version is recorded.",
  "vendor": "databasus",
  "product": "databasus",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 3.7.0, <= 3.61.0"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "databasus",
      "purl": null
    }
  ],
  "cwes": [
    307
  ],
  "cvss_score": 9.2,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
  "epss_score": 0.005,
  "epss_percentile": 0.4151,
  "epss_asof": "2026-10-21",
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 8.380376016666666,
  "t0_at": "2026-10-14T18:47:54.543000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-10-14T18:47:54.543000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-14T18:47:54.543000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-110770"
    }
  }
}