External risk intelligence

Databasement Invitation Token Bypass Allows Account Takeover

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2026-95654

The vulnerability exists in an invitation acceptance page, which is a common feature of web-based applications. Such endpoints are typically exposed to the public internet to allow users to register or join platforms, making this surface commonly reachable in standard web application deployments.

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability in Databasement allows unauthorized access to sensitive data by exploiting a flaw in how invitation tokens are validated. Attackers can intercept and reuse invitation links to gain control of accounts, potentially exposing database credentials and secrets.

Stale invitation tokens can grant unauthorized account access.
Protects sensitive database credentials and secrets.
Confirm relevance and assess exposure.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this by obtaining a leaked or forwarded invitation link. By loading the invitation acceptance page at a specific time, they can intercept the authorization process. The vulnerability allows an attacker to accept the invitation after the legitimate user has already done so, leading to unauthorized access and control over database credentials and secrets.

Entry: Obtain a leaked invitation link.
Trigger: Accept invitation after legitimate user.
Risk: Unauthorized access to sensitive data.

Live Threat

Current exploitation, exposure, and threat context

When supported by the advisory, a leaked or forwarded invitation link could allow an attacker to accept an invitation after the legitimate user has already done so. This could lead to unauthorized access to managed database credentials and secrets by overwriting the account password.

Managed database credentials and secrets.
Accepting an invitation after the legitimate user.
Gaining authenticated access to the system.

Operational Fix

Recommended remediation, mitigation, and detection steps

The primary responsibility for addressing this vulnerability likely falls to application owners and platform teams, given the nature of the Databasement software. The first practical step is to identify all instances of Databasement, confirm their external reachability and criticality, and then pinpoint the accountable owner for each instance to plan remediation.

Application owners should manage the issue.
Verify external reachability and business impact.
Coordinate vendor fix or plan remediation.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Databasement?

Databasement is a software application designed to manage database credentials and secrets. Users typically interact with it to organize, share, or access sensitive connectivity information across their development or operational environments.

What does CVE-2026-95654 mean for my security?

This vulnerability is an Improper Authorization issue (CWE-863). It occurs because the application fails to re-verify an invitation token when a user submits the acceptance form. By caching the initial authorization check, the system creates a window where a stale token can be misused to hijack the account creation process, potentially granting an attacker full control over the account and the stored database secrets.

How does an attacker trigger this vulnerability?

An attacker needs a leaked or forwarded invitation link to start the process. They must load the invitation page while it is still pending, then complete the acceptance action after a legitimate user has already accepted the invitation. Simply possessing a link is not enough; the timing of the acceptance is critical to overwriting the existing password and gaining unauthorized access.

Is my Databasement instance at risk?

According to Halo Surface Signal, this vulnerability is considered highly relevant for most deployments. Because this flaw exists in the invitation acceptance workflow—a feature typically exposed to the public internet to facilitate user onboarding—your instance is likely reachable by outside actors if it is not restricted to a private network.

What should I do if I am running this software?

First, identify all active installations of Databasement within your infrastructure. Once identified, evaluate whether these instances are accessible from the internet. Finally, coordinate with your technical teams to verify your current version and prioritize upgrading to version 1.7.14 or later to apply the necessary patch.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.