CVE-2026-110770 is a High severity (CVSS 8.1) authentication bypass in Databasus 3.7.0 through 3.61.0. The password reset code is six digits, with no rate limit or lockout, so it can be guessed. We could not confirm a fixed version, so limit exposure.
What's affected
The record says Databasus 3.7.0 through 3.61.0 is affected. VulnCheck gives the same range. Neither names a fixed release, so we do not state one. Check the databasus repository for a release that adds limits to the reset flow.
The weakness is CWE-307, improper restriction of excessive authentication attempts. Per the record, an attacker can ask for a reset code for a known email address and then guess it through the reset-password endpoint. There is no rate limit, no lockout, and no invalidation after failed guesses. That includes administrator accounts.
Severity differs by source. The record gives 8.1 (High), with high attack complexity. VulnCheck lists 9.2 (Critical) on a CVSS 4.0 vector. Our title follows the record. The scores differ because they weigh the effort of guessing differently.
How to check if you're exposed
Check the version of Databasus you run, from the web interface or the container image tag.
docker image ls | grep -i databasus
Versions 3.7.0 through 3.61.0 are in range. Then check whether the web interface is reachable from untrusted networks. A backup management tool on a public address with a known administrator email is the highest risk case.
Look at the access logs for many POST requests to the reset-password path from one address in a short time. A burst of those is a sign of guessing. Also check for password changes you did not request. The free in-browser dependency scan at gold.safeguard.sh/scan can match a manifest or lockfile against known CVEs without installing anything.
What to do now
- Restrict access to Databasus to a VPN or an allow list of addresses.
- Add rate limiting to the reset-password and login paths at your reverse proxy, for example a small number of requests per minute per address.
- Check the project for a fixed release, and upgrade once one is confirmed.
- If you see signs of guessing, reset administrator passwords, review sessions and stored database credentials, and check the backups for tampering.
- Use single sign-on or a second factor in front of the tool if you can.
Why it matters
A six-digit code has only a million possibilities. That is acceptable only when the system limits attempts, expires the code quickly, and burns it after a few wrong guesses. Without those limits, a script can cover the whole space.
The target matters too. Databasus manages database backups, so an administrator account gives access to connection details and data. Account recovery flows are part of your authentication surface, and they deserve the same limits as the login form. The record does not mark this CVE as known exploited, and none of the pages we read say it is.
Quick check
How does the attack work at a high level?
The attacker requests a reset code for a known email, then guesses the six digit value repeatedly, because the endpoint has no rate limit or lockout.
Is a fixed release available?
We could not confirm one. Check the project repository.
Sources
Last reviewed: 18 October 2026.
