Auth bypass in Cert.pl Mwdb Core
CVE-2026-66724
MWDB Core versions >=2.0.0 and <2.19.0 contain a missing authorization vulnerability in the deprecated config and blob upload endpoints. These endpoints accept the undocumented POST method, which bypasses the capability checks applied to t…
Vulnerability class: Broken Access Control
Affected products
- Cert.pl Mwdb Core — versions 2.0.0
Weakness classification (CWE)
References
- cvd@cert.pl (vendor-advisory)
- cvd@cert.pl (vendor-advisory)
- cvd@cert.pl (patch)