What’s Vulnerable › Vulnerabilities

CVE-2026-66724: Permission Bypass Via Undocumented HTTP Methods In MWDB Core

• Severity: medium (CVSS 5.3 v4.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-07-29 · updated 2026-10-23
• Weakness: CWE-862

Description

MWDB Core versions >=2.0.0 and <2.19.0 contain a missing authorization vulnerability in the deprecated config and blob upload endpoints. These endpoints accept the undocumented POST method, which bypasses the capability checks applied to the documented PUT method. This allows any authenticated user without the adding_configs or adding_blobs capabilities to upload config and text blob objects to the system. The impact is limited to adding new config and blob objects. This issue has been fixed in version 2.19.0

Affected products

• CERT.PL MWDB Core: from 2.0.0 before 2.19.0 — fixed in 2.19.0

How to fix

Upgrade to a fixed version: CERT.PL MWDB Core 2.19.0. Check the vendor advisory for mitigations.

References

• https://cert.pl/en/posts/2026/07/CVE-2026-66723
• https://github.com/CERT-Polska/mwdb-core/releases/tag/v2.19.0
• https://github.com/CERT-Polska/mwdb-core/security/advisories/GHSA-8fv8-wffg-4323

Get alerted when CVE-2026-66724 or the next vulnerability affects your stack