CVE-2026-66724

MediumCVSS 5.3

Published: 29/07/2026(UTC)Updated: 30/07/2026(UTC)Translated: 29/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.27%

19th percentile - higher than 19% of all known CVEs

Summary

A missing authorization vulnerability in MWDB Core (versions >=2.0.0 and <2.19.0) in the deprecated config and blob upload endpoints allows an authenticated user without the required capabilities to upload config and text blob objects via the POST method.

Risk Assessment

A user without proper permissions can add new configurations or blobs, potentially leading to unauthorized changes in the system.

Recommendation

Update MWDB Core to version 2.19.0 or later.

Other vulnerabilities in MWDB Core

CVE-2026-66723High
A missing authorization vulnerability in MWDB Core (versions >=2.2.0 and <2.19.0) in the Remote Instances proxy API. The proxy API does not verify authentication for incoming requests, allowing an unauthenticated attacker to send arbitrary requests to a remote MWDB instance using the identity and permissions of the configured API key. This affects only deployments with Remote Instances configured.

Original NVD description (English source)

MWDB Core versions >=2.0.0 and <2.19.0 contain a missing authorization vulnerability in the deprecated config and blob upload endpoints. These endpoints accept the undocumented POST method, which bypasses the capability checks applied to the documented PUT method. This allows any authenticated user without the adding_configs or adding_blobs capabilities to upload config and text blob objects to the system. The impact is limited to adding new config and blob objects. This issue has been fixed in version 2.19.0