Executive brief
Gorse, an open-source recommendation system engine, contains a security flaw in its administrative interface. By default, certain powerful commands used to back up or restore the entire system do not require a password. This allows an attacker to download your entire database—including sensitive user information—or completely overwrite your data, potentially leading to total data loss or a significant privacy breach.
Technical details
Gorse master nodes prior to version 0.5.10 suffer from missing authentication (CWE-306) on critical maintenance endpoints. While sibling endpoints like /api/bulk/* are protected by dashboard credentials via checkLogin(), the /api/dump and /api/restore endpoints rely on checkAdmin(). This function is hardcoded to return 'true' if the 'admin_api_key' configuration value is empty, which is the default setting. A remote, unauthenticated attacker can exploit this to perform a full database exfiltration (dump) or a full database overwrite (restore). The vulnerability also affects the /api/chat/completions endpoint. The issue is resolved in version 0.5.10 by unifying the authentication checks.
Affected products
- gorse-io Gorse < 0.5.10
Timeline
- 2026-06-15: disclosed: Issue reported and patch submitted on GitHub
- 2026-06-15: patched: Fix merged into master branch
- 2026-06-29: advisory: NVD and VulnCheck published advisory