CVE-2026-103244

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-103244

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-103244.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-103244

Aliases

GHSA-3mqj-q84c-crjq

Published

2026-10-01T10:41:51Z

Modified

2026-10-21T02:54:30Z

Severity

9.3 (Critical) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator

Summary

ground-station before 0.8.0 Authentication Bypass via setup.restore

Details

ground-station versions before 0.8.0 contain an authentication bypass vulnerability in the setup.restore command that allows unauthenticated attackers to execute arbitrary SQL during first-run setup mode. Attackers can invoke setup.restore via Socket.IO to plant admin users and forged session tokens, then authenticate as administrator without credentials for complete application takeover.

Database specific

{
    "cna_assigner":  "VulnCheck",
    "cwe_ids":  [
        "CWE-306"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/103xxx/CVE-2026-103244.json"
}

References

Affected packages

Git / github.com/sgoudelis/ground-station

Affected ranges

Type

GIT

Repo

https://github.com/sgoudelis/ground-station

Events

Introduced

Fixed

02d39c1c8b26c1adbea43688722d1cd438b9166c

Fixed

940df2128e57fa779d0ddee2d9726bd829fc61e1

Database specific

Show details

{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "0"
                },
                {
                    "fixed":  "0.8.0"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandardRange"
        },
        {
            "range":  [
                {
                    "fixed":  "940df2128e57fa779d0ddee2d9726bd829fc61e1"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        }
    ]
}

Affected versions

0.*

0.1.7

Other

push

v0.*

v0.1.10

v0.1.11

v0.1.12

v0.1.13

v0.1.14

v0.1.15

v0.1.16

v0.1.17

v0.1.18

v0.1.19

v0.1.20

v0.1.21

v0.1.22

v0.1.23

v0.1.24

v0.1.25

v0.1.26

v0.1.27

v0.1.28

v0.1.29

v0.1.3

v0.1.30

v0.1.31

v0.1.32

v0.1.33

v0.1.34

v0.1.35

v0.1.36

v0.1.37

v0.1.38

v0.1.39

v0.1.4

v0.1.40

v0.1.41

v0.1.42

v0.1.43

v0.1.44

v0.1.45

v0.1.46

v0.1.47

v0.1.48

v0.1.49

v0.1.5

v0.1.5-test1

v0.1.5-test2

v0.1.5-test3

v0.1.5-test4

v0.1.5-test5

v0.1.5-test6

v0.1.50

v0.1.51

v0.1.52

v0.1.53

v0.1.54

v0.1.55

v0.1.56

v0.1.57

v0.1.58

v0.1.59

v0.1.6

v0.1.60

v0.1.61

v0.1.62

v0.1.63

v0.1.64

v0.1.65

v0.1.66

v0.1.67

v0.1.68

v0.1.69

v0.1.7

v0.1.70

v0.1.71

v0.1.72

v0.1.73

v0.1.74

v0.1.75

v0.1.76

v0.1.77

v0.1.78

v0.1.79

v0.1.8

v0.1.80

v0.1.81

v0.1.82

v0.1.83

v0.1.84

v0.1.85

v0.1.9

v0.2.0

v0.2.1

v0.2.10

v0.2.11

v0.2.13

v0.2.14

v0.2.15

v0.2.16

v0.2.17

v0.2.18

v0.2.19

v0.2.2

v0.2.3

v0.2.4

v0.2.5

v0.2.6

v0.2.7

v0.2.8

v0.2.9

v0.3.0

v0.3.1

v0.3.10

v0.3.11

v0.3.12

v0.3.13

v0.3.14

v0.3.15

v0.3.16

v0.3.2

v0.3.3

v0.3.4

v0.3.5

v0.3.6

v0.3.7

v0.3.8

v0.3.9

v0.4.0

v0.4.1

v0.4.10

v0.4.11

v0.4.12

v0.4.13

v0.4.2

v0.4.3

v0.4.4

v0.4.5

v0.4.6

v0.4.7

v0.4.8

v0.4.9

v0.5.0

v0.5.1

v0.5.2

v0.6.0

v0.7.0

v0.7.1

v0.7.10

v0.7.11

v0.7.12

v0.7.13

v0.7.14

v0.7.15

v0.7.16

v0.7.17

v0.7.19

v0.7.2

v0.7.3

v0.7.4

v0.7.5

v0.7.6

v0.7.7

v0.7.8

v0.7.9

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-103244.json"