Vulnerability · Published May 13, 2026 · Assigned by VulnCheck

CVE-2026-45229Quark Drive (quark-auto-save) < 0.8.5 Mass Assignment via POST /update

High 8.8

In plain English

A high-severity security flaw in quark-auto-save from Cp0204. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 31% of all known vulnerabilities).

Severity (CVSS 3.1)8.8High

Exploit odds (30 days)0.4%top 69.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Quark Drive before 0.8.5 contains a mass assignment vulnerability in the POST /update endpoint that allows authenticated attackers to overwrite administrator credentials by posting an arbitrary webui object to the config_data dictionary. Attackers can exploit insufficient deny-list filtering to permanently replace stored login credentials, lock out legitimate administrators, and gain persistent access to all configured tasks, cloud tokens, and notification services.

Affected products (as reported)

Vendor	Product	Versions
Cp0204	quark-auto-save	0 – before 0.8.5

Weakness: CWE-915 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

https://github.com/Cp0204/quark-auto-save/releases/tag/v0.8.5 release-notes
https://github.com/Cp0204/quark-auto-save/commit/ea8377a596446291953dbe36e2d119d85bcd865b patch
https://www.vulncheck.com/advisories/quark-drive-mass-assignment-via-post-update third-party-advisory