CVE-2026-66724

Permission Bypass Via Undocumented HTTP Methods In MWDB Core

State: Published
Severity: 5.3 Medium
Published: Jul 29, 2026
Updated: Jul 29, 2026
Reserved: Jul 27, 2026

Description

MWDB Core versions >=2.0.0 and <2.19.0 contain a missing authorization vulnerability in the deprecated config and blob upload endpoints. These endpoints accept the undocumented POST method, which bypasses the capability checks applied to the documented PUT method. This allows any authenticated user without the adding_configs or adding_blobs capabilities to upload config and text blob objects to the system. The impact is limited to adding new config and blob objects. This issue has been fixed in version 2.19.0

Scores

CVSS	Score	Vector	Source
4.0	5.3 Medium	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N	CERT-PL

Weaknesses

CWE-862 Missing Authorization

Affected Products

Product	Versions
MWDB CoreCERT.PL	2.0.0 to before 2.19.0Affected

References

https://cert.pl/en/posts/2026/07/CVE-2026-66723vendor-advisory
https://github.com/CERT-Polska/mwdb-core/security/advisories/GHSA-8fv8-wffg-4323vendor-advisory
https://github.com/CERT-Polska/mwdb-core/releases/tag/v2.19.0patch

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.