CVE-2026-103244

CRITICAL

ground-station versions before 0.8.0 contain an authentication bypass vulnerability in the setup.restore command that allows unauthenticated attackers to execute arbitrary SQL during first-run setup mode. Attackers can invoke setup.restore via Socket.IO to plant admin users and forged session tokens, then authenticate as administrator without credentials for complete application takeover.

CVSS v3.1 Score

9.8
CRITICAL
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector
NETWORK
Complexity
LOW
Privileges
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
HIGH
Availability
HIGH
Published: 10/1/2026Modified: 10/1/2026

Related Intelligence (1)

CRITICALVulnerability

NVD CRITICAL: CVE-2026-103244 — ground-station versions before 0.8.0 contain an authentication bypass vulnerabil...

ground-station versions before 0.8.0 contain an authentication bypass vulnerability in the setup.restore command that allows unauthenticated attackers to execute arbitrary SQL during first-run setup mode. Attackers can invoke setup.restore via Socket.IO to plant admin users and forged session tokens, then authenticate as administrator without credentials for complete application takeover.

CVE-2026-103244
NIST NVD

References (4)

https://github.com/sgoudelis/ground-station/commit/940df2128e57fa779d0ddee2d9726bd829fc61e1https://github.com/sgoudelis/ground-station/security/advisories/GHSA-3mqj-q84c-crjqhttps://www.vulncheck.com/advisories/ground-station-before-0.8.0-authentication-bypass-via-setup-restorehttps://github.com/sgoudelis/ground-station/security/advisories/GHSA-3mqj-q84c-crjq