CVE-2026-125758

{
  "etk_id": "ETK-2026-4070",
  "cve_id": "CVE-2026-125758",
  "display_id": "CVE-2026-125758",
  "ghsa_id": "GHSA-gc76-cqm4-vqcf",
  "euvd_id": "EUVD-2026-121241",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Authentication bypass in Aptabase",
  "summary": "Aptabase versions before commit 61d4c01298a706d575265461ac07bb956ca7b8d2 are affected by an authentication bypass. An unauthenticated attacker can impersonate users and access analytics data or transfer application ownership when the deployment uses the publicly known example AUTH_SECRET.",
  "mitigation": "Upgrade Aptabase to commit 61d4c01298a706d575265461ac07bb956ca7b8d2 or later. Replace any example AUTH_SECRET in deployed configurations with a unique secret.",
  "vendor": "aptabase",
  "product": "aptabase",
  "affected": [
    {
      "affected_notes": [
        "main before 61d4c01"
      ],
      "affected_ranges": [],
      "ecosystem": "other",
      "fixed_versions": [
        "main from 61d4c01"
      ],
      "package_name": "ghcr.io/aptabase/aptabase",
      "purl": null
    }
  ],
  "cwes": [
    1188
  ],
  "cvss_score": 9.1,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "deterministic",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 95.21923925,
  "t0_at": "2026-11-10T15:22:52.231000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-11-10T15:22:52.231000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-11-10T15:22:52.231000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-125758"
    }
  }
}