CVE-2026-44166
HighSummary
Pocketbase, an open source web backend, has a vulnerability that allows an attacker to create and link an unverified user if they know the victim's email address. When the victim is invited to the app, the user created by the attacker will be automatically linked and verified.
Risk Assessment
The organization may be exposed to unauthorized access to user accounts, potentially leading to data loss or privacy breaches. An attacker could exploit this vulnerability to take control of user accounts.
Recommendation
It is recommended to update Pocketbase to version 0.22.42 or 0.37.4 to mitigate this vulnerability. Additionally, user accounts should be monitored for unauthorized changes.
Other vulnerabilities in Pocketbase
Original NVD description (English source)
Pocketbase is an open source web backend written in go. Prior to 0.22.42 and 0.37.4, in some situations, if an attacker knows the email address of the victim they can create and link an unverified PocketBase user in advance by authenticating with one of the OAuth2 app providers, e.g. "A". When the victim gets invited or decides to sign up to your app on their own with provider "B" (PocketBase OAuth2 auth requires to be with a different provider because we don't allow multiple OAuth2 accounts from the same provider to be associated to a single PocketBase user), the user created previously by the attacker will be autolinked, upgraded to "verified" and its old password reset. This vulnerability is fixed in 0.22.42 and 0.37.4.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS