Skip to content
OpenAdvisories

Package · Go

github.com/pocketbase/pocketbase

3 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Feed

  • High 8.7
    CVE-2026-82410

    Pocketbase: Unhandled panic in worker goroutines

    Pocketbase is an open source web backend written in go. Prior to 0.22.48 and 0.39.7, PocketBase's panic-recovery middleware covers regular request handling but not internal child and worker goroutines. A panic in one of these internal goroutines can escape re…

    pocketbase pocketbase github.com/pocketbase/pocketbase Go
  • Medium 6.1
    CVE-2026-44166 Public exploit

    Pocketbase: Account pre-hijacking via OAuth2 unverfied->verified autolinking upgrade

    Pocketbase is an open source web backend written in go. Prior to 0.22.42 and 0.37.4, in some situations, if an attacker knows the email address of the victim they can create and link an unverified PocketBase user in advance by authenticating with one of the O…

    pocketbase pocketbase github.com/pocketbase/pocketbase Go
  • Medium 5.4
    CVE-2024-38351

    Password auth and OAuth2 unverified email linking

    Pocketbase is an open source web backend written in go. In affected versions a malicious user may be able to compromise other user accounts. In order to be exploited users must have both OAuth2 and Password auth methods enabled. A possible attack scenario cou…

    pocketbase pocketbase github.com/pocketbase/pocketbase Go