AIKIDO-2026-632472
mwdb-core is vulnerable to Missing Authorization
53
Medium Risk
This Affects:
mwdb-coreTL;DR
The deprecated upload endpoints /api/config/{identifier} and /api/blob/{identifier} in mwdb-core accept the undocumented POST method in addition to the documented PUT method. The POST path skips the capability checks that guard the PUT handler. Before the fix, an authenticated user lacking the adding_configs or adding_blobs capability can create config or text blob objects through the POST method. The fix removes the legacy handlers and routes uploads through schema-validated, capability-gated object creation.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and untrusted or low-privileged users can obtain authenticated accounts on your MWDB Core instance. Exploitation requires an authenticated account but does not require the adding_configs or adding_blobs capability, and impact is limited to creating new config and text blob objects.
Background info
mwdb-core is vulnerable to Missing Authorization in versions 2.0.0 - 2.18.0.
How to fix this
Upgrade the mwdb-core library to the patch version.
Links
GitHub Release
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant