CVE-2026-95654: Databasement Auth Bypass Vulnerability

CVE-2026-95654 Overview

CVE-2026-95654 is an authorization bypass vulnerability in Databasement, a database management application, affecting all versions before 1.7.14. The flaw resides in the invitation acceptance workflow, where token validity is checked only when the acceptance page loads. The authorization decision is cached and not re-verified when the user submits the acceptance form. An attacker with a leaked or forwarded invitation link can load the page while the invitation is still pending, wait for the legitimate user to accept, and then submit the cached form to overwrite the account password. This grants the attacker authenticated access to managed database credentials and secrets. The weakness is classified under CWE-863: Incorrect Authorization.

Critical Impact
Successful exploitation lets an unauthenticated network attacker take over an invited user's account and access managed database credentials, connection strings, and stored secrets.

Affected Products

Databasement versions prior to 1.7.14
Affected component: app/Livewire/Auth/AcceptInvitation.php
Affected component: app/Livewire/DatabaseServer/AdminerModal.php

Discovery Timeline

2026-09-22 - CVE-2026-95654 published to NVD
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-95654

Vulnerability Analysis

Databasement uses a Livewire component (AcceptInvitation) to process user invitations. When the page loads, the component validates the invitation token and hydrates two public properties: $user and $token. Livewire persists these properties across the component lifecycle. When the invitee submits the password form, the component reads the previously hydrated properties and updates the target user without re-verifying that the token remains valid.

Because invitation tokens are single-use only at the point of page load, an attacker who obtained the link through email forwarding, log leaks, or referrer disclosure can prepare a browser session with the pending invitation state loaded. After the legitimate user completes acceptance, the attacker submits their own form and overwrites the account password. The result is full account takeover of a managed identity with access to database credentials and secrets stored in the platform.

Root Cause

The root cause is a time-of-check to time-of-use pattern combined with client-side property tampering exposure. The invitation validity check occurs once during component mount, but the mutation action (password change) does not re-query the invitation state. Additionally, the $user and $token public properties were not marked as #[Locked], allowing them to be manipulated in transit between the client and server.

Attack Vector

Exploitation requires network access to the Databasement instance and a leaked or forwarded invitation link. No authentication or user interaction from the attacker's perspective is required beyond loading the invitation URL. The attack proceeds as follows: load the invitation page while pending, wait for the legitimate acceptance, then submit the acceptance form to overwrite credentials on the already-accepted account.

php

// Security patch for app/Livewire/Auth/AcceptInvitation.php
 use Illuminate\Contracts\View\View;
 use Illuminate\Support\Facades\Auth;
 use Livewire\Attributes\Layout;
+use Livewire\Attributes\Locked;
 use Livewire\Attributes\Validate;
 use Livewire\Component;

 class AcceptInvitation extends Component
 {
     use Toast;

+    #[Locked]
     public User $user;

+    #[Locked]
     public string $token;

     #[Validate('required|string|min:8|confirmed')]

Source: GitHub Commit 128efeaf. The #[Locked] attribute prevents client-side modification of the hydrated properties, and the accompanying commit re-verifies the invitation server-side before applying the password change.

php

// Companion fix for app/Livewire/DatabaseServer/AdminerModal.php
     public string $adminerUrl = '';

     #[On('open-adminer-modal')]
-    public function openModal(string $serverName, string $databaseIcon, string $databaseType, string $adminerUrl): void
+    public function openModal(string $serverName, string $databaseIcon, string $databaseType): void
     {
         $this->serverName = $serverName;
         $this->databaseIcon = $databaseIcon;
         $this->databaseType = $databaseType;
-        $this->adminerUrl = $adminerUrl;
+        $this->adminerUrl = route('adminer');
         $this->showModal = true;
     }

Source: GitHub Commit 128efeaf. The patch derives the Adminer frame URL server-side instead of trusting a client-supplied value.

Detection Methods for CVE-2026-95654

Indicators of Compromise

Multiple successful acceptances of the same invitation token in application logs
Unexpected password changes on accounts within minutes of invitation acceptance
Two distinct IP addresses or user agents loading the same /accept-invitation URL
Successful authentication from a user immediately followed by credential-vault access from an unfamiliar geolocation

Detection Strategies

Instrument the AcceptInvitation Livewire endpoint to log token, requester IP, and outcome for every mount and submit event
Alert when a password reset originates from an invitation flow more than once per token
Correlate access to database credentials and secrets against the identity of the last successful invitation acceptance

Monitoring Recommendations

Forward Databasement application logs to a centralized analytics platform and retain them for at least 90 days
Monitor egress traffic from the Databasement host for anomalous connections to managed database endpoints
Track invitation lifecycle events (created, viewed, accepted, expired) and flag any state transitions that occur after acceptance

How to Mitigate CVE-2026-95654

Immediate Actions Required

Upgrade all Databasement deployments to version 1.7.14 or later without delay
Invalidate all outstanding invitation tokens and reissue invitations from the patched version
Force password resets for any accounts created through invitations while running an affected version
Rotate database credentials and secrets that may have been accessed by a compromised account

Patch Information

The fix is available in Databasement release v1.7.14. The patch adds the Livewire #[Locked] attribute to the $user and $token properties in AcceptInvitation.php and re-verifies the invitation on password submission. See the VulnCheck advisory for full remediation guidance.

Workarounds

Restrict network access to the invitation acceptance endpoint using an authenticating reverse proxy or VPN until patching is complete
Manually expire pending invitations that are older than a short window (for example, 15 minutes)
Disable the invitation feature and provision accounts through an out-of-band administrative workflow

bash

# Upgrade to the patched release
git fetch --tags
git checkout v1.7.14
composer install --no-dev --optimize-autoloader
php artisan migrate --force
php artisan config:cache
php artisan view:cache