---
id: CVE-2026-95654
title: >-
  Databasement before 1.7.14 validates invitation tokens only when the
  acceptance page loads, caching the authorization decision without re-checking
  token validity during acceptance
summary: >-
  Databasement before 1.7.14 validates invitation tokens only when the
  acceptance page loads, caching the authorization decision without re-checking
  token validity during acceptance. Attackers with a leaked or forwarded
  invitation link can…
severity: high
cvss: 7.4
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N'
cwe:
  - CWE-863
vendor: David-Crty
product: Databasement
affected:
  - Databasement < 1.7.14
published: '2026-09-22'
updated: '2026-09-23'
sourceUpdated: '2026-09-23T17:17:48.367'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-95654'
references:
  - url: 'https://github.com/David-Crty/databasement'
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/David-Crty/databasement/blob/v1.7.13/app/Livewire/Auth/AcceptInvitation.php#L30
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/David-Crty/databasement/blob/v1.7.13/app/Livewire/Auth/AcceptInvitation.php#L45
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/David-Crty/databasement/commit/128efeaf6bc9ad4a63940f4c3030a56ab2969778
    label: disclosure@vulncheck.com
  - url: 'https://github.com/David-Crty/databasement/releases/tag/v1.7.14'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/databasement-before-1.7.14-authorization-bypass-via-stale-invitation-token
    label: disclosure@vulncheck.com
tags:
  - nvd
  - cve.org
epss: 0.00514
epssPercentile: 0.41212
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-09-22T15:48:26.638426Z'
ingestedAt: '2026-09-22T16:06:00.474Z'
---

## Overview

Databasement before 1.7.14 validates invitation tokens only when the acceptance page loads, caching the authorization decision without re-checking token validity during acceptance. Attackers with a leaked or forwarded invitation link can load the page while pending, then accept the invitation after the legitimate user has already accepted it to overwrite the account password and gain authenticated access to managed database credentials and secrets.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.