CVE-2026-95654 in Databasement
Summary
by MITRE • 09/22/2026
Databasement before 1.7.14 validates invitation tokens only when the acceptance page loads, caching the authorization decision without re-checking token validity during acceptance. Attackers with a leaked or forwarded invitation link can load the page while pending, then accept the invitation after the legitimate user has already accepted it to overwrite the account password and gain authenticated access to managed database credentials and secrets.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/22/2026
The vulnerability in Databasement versions prior to 1.7.14 represents a critical flaw in the authentication flow for invited users, specifically stemming from an improper handling of state during token validation. The core technical issue lies in the application's decision-making process regarding invitation acceptance. When a user accesses the invitation page, the system validates the provided invitation token and caches this authorization decision to improve performance or simplify session management. However, this cached decision is not re-verified at the critical moment when the user actually submits their details to accept the invitation. This architectural oversight creates a race condition window where the validity of the token is decoupled from the final acceptance action. Consequently, if an attacker obtains a valid but pending invitation link through leakage or forwarding, they can exploit this timing gap by loading the page initially and then attempting to finalize the acceptance after the legitimate invitee has already completed their registration.
From an operational security perspective, this flaw allows for account takeover via privilege escalation. By accepting the invitation after the legitimate user, the attacker effectively overwrites the password associated with that email address or identity within the application's database. This results in the attacker gaining full authenticated access to the managed database credentials and secrets stored under that account. The impact is severe because it bypasses standard multi-factor authentication protections if they are tied to initial login rather than specific administrative actions, and it compromises sensitive data such as connection strings, API keys, or other confidential configuration details associated with the compromised identity. This scenario highlights a failure in enforcing unique acceptance constraints, allowing multiple entities to claim ownership of the same invitation resource without proper conflict resolution mechanisms like token invalidation upon first use.
This vulnerability aligns closely with CWE-284, which describes Improper Access Control, as well as CWE-367, Time-of-check Time-of-use (TOCTOU) Race Condition. The attacker exploits a discrepancy between the time the access right is checked and when it is used to perform an action that relies on that check. In terms of MITRE ATT&CK framework tactics, this behavior facilitates Initial Access through valid accounts obtained via social engineering or credential leakage, followed by Credential Access as the attacker takes over existing identities rather than creating new ones from scratch. The lack of idempotency in the invitation acceptance process is a common pattern in web applications that prioritize performance over strict state consistency during critical user onboarding flows.
To mitigate this vulnerability, developers must implement robust token lifecycle management for all authentication and authorization events involving invitations or password resets. Specifically, the system should invalidate the invitation token immediately upon its first successful use by any party, ensuring that subsequent attempts to accept the same invitation are rejected with a clear error message indicating the link has expired or been used. Additionally, implementing atomic operations during the acceptance process can prevent race conditions where multiple requests arrive simultaneously. It is also advisable to introduce explicit confirmation steps for sensitive actions like password changes on existing accounts, requiring verification of current credentials before allowing an overwrite. Regular security audits focusing on state management and session handling in user-facing forms are essential to identify similar logic flaws across other modules within the application architecture.