CVE-2026-103244GHSA-3MQJ-Q84C-CRJQ
ground-station before 0.8.0 Authentication Bypass via setup.restore
- Published
- Last modified
- Status
- published
- Known exploitation
- Not listed in CISA KEV
- Fix
- Fixed in 0.8.0
- Public exploit
- None on Exploit-DB
CISA SSVC
- Exploitation: poc
- Automatable: yes
- Technical impact: total
?
Decision points from CISA's Vulnrichment, assessed (SSVC 2.0.3).
SSVC documentationSummary
ground-station versions before 0.8.0 contain an authentication bypass vulnerability in the setup.restore command that allows unauthenticated attackers to execute arbitrary SQL during first-run setup mode. Attackers can invoke setup.restore via Socket.IO to plant admin users and forged session tokens, then authenticate as administrator without credentials for complete application takeover.
Affected versions
- sgoudelis ground-station
fixed in 0.8.0