Description

Databasement before 1.7.14 validates invitation tokens only when the acceptance page loads, caching the authorization decision without re-checking token validity during acceptance. Attackers with a leaked or forwarded invitation link can load the page while pending, then accept the invitation after the legitimate user has already accepted it to overwrite the account password and gain authenticated access to managed database credentials and secrets.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.4",
  "pubDate": "2026-09-22T16:18:18.770Z",
  "pubdate": "2026-09-22T16:18:18.770Z",
  "executiveSummary": "Databasement versions prior to 1.7.14 are susceptible to an improper authorization vulnerability concerning the handling of invitation tokens. The flaw arises from an insecure validation logic where the application caches authorization decisions at the initial page load rather than re-validating the token's state upon the final submission of the acceptance action.\nThis vulnerability allows an attacker who has intercepted a legitimate invitation link to bypass intended security controls. By loading the invitation page while the token is still active, an attacker can maintain a cached authorization state. Even if the legitimate user subsequently consumes the token, the attacker's pre-loaded session remains valid, permitting them to finalize the acceptance process.\nSuccessful exploitation enables unauthorized account takeovers. By overwriting an account's password during the deferred acceptance phase, an attacker gains full authenticated access to the target environment. This leads to the exposure of sensitive managed database credentials and stored secrets. The risk is high for organizations relying on Databasement for secret management, as the exploit requires no administrative privileges, only possession of an invitation URL. The primary requirement for exploitation is the interception of an invitation link before or during the legitimate user's interaction with the workflow.",
  "technicalDetails": "The root cause of this vulnerability lies in a flawed state-validation mechanism within the Databasement invitation workflow. In affected versions (pre-1.7.14), the application performs authorization checks upon the initial GET request to the invitation acceptance page. Upon successful validation of the token at this stage, the backend caches the authorization decision, associating the token's permissions with the user's session or the client's transient state.\nThe application fails to implement a secondary, mandatory validation check during the subsequent POST request that completes the invitation acceptance. Consequently, the system assumes the token remains valid and authorized simply because the session was validated during the initial GET request. This design creates a Time-of-Check to Time-of-Use (TOCTOU) race condition or logic flaw.\nThe attack flow proceeds as follows: 1) The attacker gains access to a legitimate invitation link, potentially through network monitoring, log access, or email interception. 2) The attacker visits the invitation page to trigger the initial validation, causing the server to cache the 'authorized' state for that specific token/session. 3) The legitimate user completes the invitation process normally, which should invalidate the token. 4) Because the server does not re-verify the token's validity upon the final submission, the attacker, who still holds the cached session, executes the final POST request. 5) The application processes the request, allowing the attacker to define a new password for the account, effectively hijacking the user identity.\nThis vulnerability resides in the authentication and invitation-handling components of the Databasement service. It does not require prior authentication to the application, as the entry point is the invitation acceptance flow itself. The network exposure is limited to the web interface serving the invitation page. The post-exploitation impact is severe, as it grants the attacker persistent access to the platform, including the ability to retrieve database credentials, environment variables, and other secrets managed by the Databasement instance.\nThe lack of atomicity between the validation of the invitation token and the final password-setting operation is the critical failure point. Remediation necessitates enforcing a strict, stateless validation check that queries the database for the current token status at the exact moment of the final write operation, ensuring that tokens cannot be reused or utilized after their initial consumption."
}