EUVD-2026-50358Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible endpoint requiring authenticated low-privilege access only; impact strictly limited to unauthorized object insertion with no confidentiality or availability effect.
Primary rating from Vendor (CERT-PL).
CVSS VectorVendor: CERT-PL
Lifecycle Timeline
2DescriptionCVE.org
MWDB Core versions >=2.0.0 and <2.19.0 contain a missing authorization vulnerability in the deprecated config and blob upload endpoints. These endpoints accept the undocumented POST method, which bypasses the capability checks applied to the documented PUT method. This allows any authenticated user without the adding_configs or adding_blobs capabilities to upload config and text blob objects to the system. The impact is limited to adding new config and blob objects. This issue has been fixed in version 2.19.0
AnalysisAI
Missing authorization in MWDB Core versions 2.0.0 through 2.18.x allows any authenticated user to bypass capability-based access controls and upload malware configuration and text blob objects they are not permitted to add. The deprecated legacy endpoints /config/<parent_dhash> and /blob/<parent_dhash> silently accept an undocumented POST method that carries none of the adding_configs or adding_blobs capability checks enforced on the documented PUT method. No public exploit code has been identified and this vulnerability is not listed in CISA KEV, but the low attack complexity and network accessibility make it a meaningful privilege-boundary bypass in any multi-user MWDB Core deployment. Vendor-released patch v2.19.0 resolves the issue.
Technical ContextAI
MWDB Core (cpe:2.3:a:cert.pl:mwdb_core) is a malware repository and analysis platform maintained by CERT-PL, used by security research teams to store, tag, and correlate malware samples, configurations, and associated metadata. The vulnerable surface is a pair of deprecated REST API routes - /config/<parent_dhash> and /blob/<parent_dhash> - that were superseded by documented PUT-method endpoints. The root cause is CWE-862 (Missing Authorization): the application's capability-check middleware was correctly wired to the documented PUT method, but the same URL paths also accepted an undocumented POST method that was never subjected to those checks. This is a textbook incomplete HTTP-method coverage flaw - security control applied to the intended verb but not to an alternative one on the identical route. The fix in v2.19.0 (PR #1248) removes the undocumented POST method entirely from the legacy endpoints.
RemediationAI
Upgrade to MWDB Core v2.19.0, which removes the undocumented POST method from the deprecated /config/<parent_dhash> and /blob/<parent_dhash> endpoints (PR #1248 by @psrok1). The patched release is available at https://github.com/CERT-Polska/mwdb-core/releases/tag/v2.19.0. If immediate upgrade is not feasible, a targeted compensating control is to configure a reverse proxy or WAF rule to reject POST requests to URL paths matching /config/ and /blob/ legacy routes - note this could disrupt any tooling that inadvertently uses those paths, so inventory API clients before applying. Restricting API access to only explicitly trusted accounts at the network or application layer reduces exposure but does not eliminate it, as the bypass is exploitable by any valid authenticated session. There are no known side effects to the v2.19.0 upgrade specific to this fix.
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today