CVE-2026-95654 is a high severity (CVSS 7.4) authorization flaw in Databasement before 1.7.14. A leaked or forwarded invitation link can be used to overwrite an account password after the legitimate user has already accepted the invitation. The fix is Databasement 1.7.14.
What's affected
The record says Databasement before 1.7.14 is affected, and the project has a v1.7.14 release. The weakness is CWE-863, incorrect authorization.
Per the record, the invitation token is checked only when the acceptance page loads, and that decision is cached. It is not checked again when the invitation is accepted. An attacker with a leaked or forwarded link can load the page while the invitation is pending, wait until the real user has accepted, then accept it themselves to overwrite the account password and gain authenticated access to managed database credentials and secrets.
The vector is network, high complexity, no privileges. The high complexity reflects the need to have the link and to time the acceptance. The code the record points to is the AcceptInvitation component in v1.7.13.
How to check if you're exposed
Databasement is a self hosted tool for database backups, and its documentation shows Docker, Docker Compose, Kubernetes and native installs. Find out which version each of your instances runs.
docker ps --format '{{.Names}} {{.Image}}'
docker inspect --format '{{.Image}}' CONTAINER
If you track the floating major tag, pull the latest image and check the version shown in the application after the update. Then review invitations. List any that are still pending, and any accepted recently by people you did not expect.
What to do now
- Upgrade to Databasement 1.7.14 or later and restart the application.
- Revoke any pending invitations and send fresh ones to the people who need them.
- Review accounts created or changed through invitations in the last weeks, and reset any password you cannot explain.
- If you suspect misuse, rotate the database credentials and secrets stored in Databasement, since the account gives access to them.
- Share invitation links only over channels you trust and avoid pasting them into tickets or chat rooms.
Why it matters
Invitation links are bearer tokens. Whoever holds the link can act as the invited person, so the system has to check that the token is still valid at the moment it matters, which is when the invitation is accepted. CWE-863 describes a check that happened at the wrong time or not at all. Here the check ran when the page loaded and its result was reused later.
The prize is large. Databasement holds credentials for the databases it backs up, so a takeover of one account can reach many systems. The record does not mark exploitation, and the CVE is not in CISA's catalog.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Does the attacker need to know my users?
They need a leaked or forwarded invitation link, according to the record.
What should I do about secrets?
If you think the flaw was used, rotate the database credentials stored in the tool.
Sources
Last reviewed: 18 October 2026.
