CVE-2026-103244 — ground-station before 0.8.0 Authentication Bypass via setup.restore
ground-station versions before 0.8.0 contain an authentication bypass vulnerability in the setup.restore command that allows unauthenticated attackers to execute arbitrary SQL d…
Published: 2026-10-01 · CVSS: 9.3 · CVSS 4.0
ground-station versions before 0.8.0 contain an authentication bypass vulnerability in the setup.restore command that allows unauthenticated attackers to execute arbitrary SQL during first-run setup mode. Attackers can invoke setup.restore via Socket.IO to plant admin users and forged session tokens, then authenticate as administrator without credentials for complete application takeover.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7