CVE-2026-66723

HighCVSS 7.0

Published: 29/07/2026(UTC)Updated: 30/07/2026(UTC)Translated: 29/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.49%

40th percentile - higher than 40% of all known CVEs

Summary

A missing authorization vulnerability in MWDB Core (versions >=2.2.0 and <2.19.0) in the Remote Instances proxy API. The proxy API does not verify authentication for incoming requests, allowing an unauthenticated attacker to send arbitrary requests to a remote MWDB instance using the identity and permissions of the configured API key. This affects only deployments with Remote Instances configured.

Risk Assessment

An unauthenticated attacker can perform unauthorized actions on the remote MWDB instance, such as data modification or access to sensitive information, compromising integrity and confidentiality.

Recommendation

Update MWDB Core to version 2.19.0, which fixes the missing authorization in the proxy API.

Other vulnerabilities in MWDB Core

CVE-2026-66724Medium
A missing authorization vulnerability in MWDB Core (versions >=2.0.0 and <2.19.0) in the deprecated config and blob upload endpoints allows an authenticated user without the required capabilities to upload config and text blob objects via the POST method.

Original NVD description (English source)

MWDB Core versions >=2.2.0 and <2.19.0 contain a missing authorization vulnerability in the Remote Instances proxy API. The proxy API does not verify authentication for incoming requests, allowing an unauthenticated remote attacker to send arbitrary requests to a remote MWDB instance using the identity and permissions associated with the configured API key. This can result in unauthorized actions being performed on the remote instance as if executed by the user whose API key was used to set up the remote instance. The vulnerability is limited to deployments where Remote Instances have been configured.This issue has been fixed in version 2.19.0