gorse-io/gorse

gorse-io/gorse

GitHubGitHub
GitHubgithub.com
gorse.iogorse.io
Releases53
Frequency1 month 5 days
Last Release
Stars9.76K
AI powered open source recommender system engine supports classical/LLM rankers and multimodal content via embedding
Log in to subscribe

CVE History

CVEAffectedPublishedCVSS v3CVSS v2
CVE-2026-56782NVD↗
—9.8 CRITICAL—

Gorse before 0.5.10 contains an authentication bypass vulnerability in the /api/dump and /api/restore endpoints that allows unauthenticated attackers to access protected functionality when admin_api_key is empty, which is the default configuration. Remote attackers can exfiltrate the entire database including user records, items, and feedback data containing personally identifiable information, or completely overwrite the dataset without authentication.