AIKIDO-2026-632472

mwdb-core is vulnerable to Missing Authorization

CVE-2026-66724Published Aug 3, 2026

CVE Score

Medium

Missing Authorization

TL;DR

The deprecated upload endpoints /api/config/{identifier} and /api/blob/{identifier} in mwdb-core accept the undocumented POST method in addition to the documented PUT method. The POST path skips the capability checks that guard the PUT handler. Before the fix, an authenticated user lacking the adding_configs or adding_blobs capability can create config or text blob objects through the POST method. The fix removes the legacy handlers and routes uploads through schema-validated, capability-gated object creation.

How do I fix this?

Upgrade the mwdb-core library to the patch version.

Who does this affect?

You are affected if you are using a version that falls within the vulnerable range and untrusted or low-privileged users can obtain authenticated accounts on your MWDB Core instance. Exploitation requires an authenticated account but does not require the adding_configs or adding_blobs capability, and impact is limited to creating new config and text blob objects.