CVE-2026-66724

Deferred Deferred - Pending Action

Missing Authorization in MWDB Core Allows Config Upload

Publication date: 2026-07-29

Last updated on: 2026-07-29

Assigner: CERT.PL

Description

MWDB Core versions >=2.0.0 and <2.19.0 contain a missing authorization vulnerability in the deprecated config and blob upload endpoints. These endpoints accept the undocumented POST method, which bypasses the capability checks applied to the documented PUT method. This allows any authenticated user without the adding_configs or adding_blobs capabilities to upload config and text blob objects to the system. The impact is limited to adding new config and blob objects. This issue has been fixed in version 2.19.0

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-29

Last Modified

2026-07-29

Generated

2026-08-19

AI Q&A

2026-07-30

EPSS Evaluated

2026-08-18

NVD

CVE-2026-66724

Affected Vendors & Products

Vendor	Product	Version / Range
mwdb	core	From 2.0.0 (inc) to 2.19.0 (exc)
mwdb	core	2.19.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

This vulnerability affects MWDB Core versions between 2.0.0 and 2.19.0. It involves missing authorization checks in deprecated endpoints for config and blob uploads. The endpoints incorrectly accept POST requests, which bypass capability restrictions that apply to the documented PUT method. This allows authenticated users without specific permissions to upload config and text blob objects.

Detection Guidance

Detecting this vulnerability requires checking for unauthorized POST requests to the deprecated config and blob upload endpoints in MWDB Core versions between 2.0.0 and 2.18.0. Monitor server logs for POST requests to paths like /api/config or /api/blob with 200 or 201 responses from authenticated users without proper capabilities.

Impact Analysis

The impact is limited to unauthorized users being able to add new config and blob objects to the system. This could lead to data pollution, incorrect analysis results, or potential misuse of the system if malicious objects are uploaded. However, it does not allow access to existing data or system control.

Compliance Impact

The vulnerability allows unauthorized users to upload config and blob objects, which could potentially lead to data integrity issues or unauthorized data storage. This may impact compliance with GDPR (data integrity and unauthorized processing) and HIPAA (integrity and access controls) if sensitive data is involved.

Mitigation Strategies

Upgrade MWDB Core to version 2.19.0 or later immediately. If upgrading is not possible, disable the deprecated endpoints by restricting POST method access to /api/config and /api/blob paths. Review logs for any unauthorized uploads and revoke access for affected users.

Hi! I’m here to help you understand CVE-2026-66724. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70