Vulnerability · Published Jul 29, 2026 · Assigned by CERT-PL

CVE-2026-66724Permission Bypass Via Undocumented HTTP Methods In MWDB Core

Medium 5.3

In plain English

A medium-severity missing authorization in MWDB Core from CERT.PL. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 38% of all known vulnerabilities).

Severity (CVSS 4.0)5.3Medium

Exploit odds (30 days)0.4%top 61.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

MWDB Core versions >=2.0.0 and <2.19.0 contain a missing authorization vulnerability in the deprecated config and blob upload endpoints. These endpoints accept the undocumented POST method, which bypasses the capability checks applied to the documented PUT method. This allows any authenticated user without the adding_configs or adding_blobs capabilities to upload config and text blob objects to the system. The impact is limited to adding new config and blob objects. This issue has been fixed in version 2.19.0

Affected products (as reported)

Vendor	Product	Versions
CERT.PL	MWDB Core	2.0.0 – before 2.19.0

Weakness: CWE-862 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

References

https://cert.pl/en/posts/2026/07/CVE-2026-66723 vendor-advisory
https://github.com/CERT-Polska/mwdb-core/security/advisories/GHSA-8fv8-wffg-4323 vendor-advisory
https://github.com/CERT-Polska/mwdb-core/releases/tag/v2.19.0 patch