CVE-2026-66723

Missing authentication requirement in Remote Instances proxy API in MWDB Core

State: Published
Severity: 7.0 High
Published: Jul 29, 2026
Updated: Jul 29, 2026
Reserved: Jul 27, 2026

Description

MWDB Core versions >=2.2.0 and <2.19.0 contain a missing authorization vulnerability in the Remote Instances proxy API. The proxy API does not verify authentication for incoming requests, allowing an unauthenticated remote attacker to send arbitrary requests to a remote MWDB instance using the identity and permissions associated with the configured API key. This can result in unauthorized actions being performed on the remote instance as if executed by the user whose API key was used to set up the remote instance. The vulnerability is limited to deployments where Remote Instances have been configured.This issue has been fixed in version 2.19.0

Scores

CVSS	Score	Vector	Source
4.0	7.0 High	CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N	CERT-PL

Weaknesses

CWE-862 Missing Authorization

Affected Products

Product	Versions
MWDB CoreCERT.PL	2.2.0 to before 2.19.0Affected

References

https://cert.pl/en/posts/2026/07/CVE-2026-66723vendor-advisory
https://github.com/CERT-Polska/mwdb-core/security/advisories/GHSA-942c-r7qj-w895vendor-advisory
https://github.com/CERT-Polska/mwdb-core/releases/tag/v2.19.0patch

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.