CVE-2026-56782: Gorse Auth Bypass Vulnerability

CVE-2026-56782 Overview

CVE-2026-56782 is an authentication bypass vulnerability in Gorse, an open-source recommender system, affecting versions prior to 0.5.10. The /api/dump and /api/restore endpoints fail to enforce authentication when the admin_api_key configuration value is empty, which is the default state. Unauthenticated remote attackers can exfiltrate the full database, including user records, items, and feedback data containing personally identifiable information (PII). The same flaw allows attackers to overwrite the entire dataset via /api/restore, enabling data destruction or poisoning of recommendation models.

Critical Impact
Remote, unauthenticated attackers can dump or overwrite the complete Gorse database over the network in default deployments.

Affected Products

Gorse recommender system versions prior to 0.5.10
Deployments using the default configuration where admin_api_key is empty
Any Gorse master node exposing the REST API to untrusted networks

Discovery Timeline

2026-06-29 - CVE-2026-56782 published to the National Vulnerability Database
2026-06-29 - Last updated in NVD database

Technical Details for CVE-2026-56782

Vulnerability Analysis

The vulnerability is a Missing Authentication for Critical Function issue tracked under [CWE-306]. Gorse's master node exposes administrative REST endpoints, including /api/dump (full database export) and /api/restore (full database import). Access control on these endpoints depends on the checkAdmin function, which validates the X-API-Key header against the configured admin_api_key.

When admin_api_key is unset — the default in shipped configuration — checkAdmin returns true unconditionally. This converts the administrative interface into an open endpoint reachable by any network client. Attackers can read the entire dataset or replace it with attacker-controlled content, breaking confidentiality, integrity, and availability of the recommender data.

Root Cause

The root cause is a permissive fallback in the checkAdmin function inside master/rest.go. The function treated an empty admin_api_key as an authorization grant instead of a misconfiguration to be rejected. Sensitive endpoints inherited this permissive check without enforcing a separate mandatory-authentication requirement.

Attack Vector

Exploitation requires only network reachability to the Gorse master API. An attacker issues an HTTP GET request to /api/dump to exfiltrate records, or an HTTP POST request to /api/restore with a crafted payload to overwrite the database. No credentials, tokens, or user interaction are required.

// Vulnerable checkAdmin implementation removed by the upstream patch
// Source: https://github.com/gorse-io/gorse/commit/19fdcbb309fb5b609e9cc3eb10c74885b5b27da9

func (m *Master) checkAdmin(request *http.Request) bool {
    if m.Config.Master.AdminAPIKey == "" {
        return true
    }
    if request.Header.Get("X-API-Key") == m.Config.Master.AdminAPIKey {
        return true
    }
    return false
}

The upstream patch removes this permissive check and enforces authentication on the dump and restore handlers directly.

Detection Methods for CVE-2026-56782

Indicators of Compromise

HTTP requests to /api/dump or /api/restore on Gorse master nodes from unexpected source IPs.
Requests to these endpoints without an X-API-Key header, or with an empty header value.
Unusually large outbound responses from the Gorse master port following /api/dump requests.
Unexpected mass changes in user, item, or feedback tables consistent with a /api/restore overwrite.

Detection Strategies

Enable HTTP access logging on the Gorse master and alert on any request whose path matches /api/dump or /api/restore.
Correlate reverse proxy logs against an allowlist of administrative source IPs for the Gorse API.
Hash-monitor exported database snapshots to identify unauthorized dumps or unexpected restores.

Monitoring Recommendations

Deploy network IDS signatures for the string patterns GET /api/dump and POST /api/restore targeting Gorse ports.
Baseline normal API traffic volumes and alert on outbound transfer spikes from the master node.
Review the running Gorse configuration to confirm admin_api_key is populated and rotated on a defined schedule.

How to Mitigate CVE-2026-56782

Immediate Actions Required

Upgrade Gorse to version 0.5.10 or later, which contains the official patch.
Set a strong, random admin_api_key in the Gorse configuration on every deployment, including test and staging.
Restrict network access to the Gorse master API using firewall rules or a reverse proxy that requires authentication.
Audit access logs for prior unauthenticated requests to /api/dump and /api/restore and treat any hits as a suspected data breach.

Patch Information

The fix is delivered in Gorse 0.5.10 via commit 19fdcbb309fb5b609e9cc3eb10c74885b5b27da9. The patch removes the permissive checkAdmin fallback and enforces API key validation on the dump and restore handlers. Additional context is available in the VulnCheck security advisory and the GitHub issue discussion.

Workarounds

Configure a non-empty admin_api_key value and restart the Gorse master to disable the vulnerable code path if immediate upgrade is not possible.
Place the Gorse master behind an authenticating reverse proxy such as Nginx or Envoy that blocks /api/dump and /api/restore from untrusted networks.
Bind the Gorse master API to 127.0.0.1 or an internal management interface only reachable by authorized operators.

bash

# Example gorse.toml configuration hardening
[master]
# Set a strong random key; never leave this empty in production
admin_api_key = "$(openssl rand -hex 32)"
http_host = "127.0.0.1"
http_port = 8086