QwikSec

Security Database

CVE

CWE

Training

CVE Database
/

CVE-2026-45229

Back to search

CVE-2026-45229

Published: May 13, 2026

Modified: May 25, 2026

PUBLISHED

CVSS v3.1

8.8

HIGH

Description

Quark Drive before 0.8.5 contains a mass assignment vulnerability in the POST /update endpoint that allows authenticated attackers to overwrite administrator credentials by posting an arbitrary webui object to the config_data dictionary. Attackers can exploit insufficient deny-list filtering to permanently replace stored login credentials, lock out legitimate administrators, and gain persistent access to all configured tasks, cloud tokens, and notification services.

VendorProductVersions

Cp0204

quark-auto-save

affected
0 - < 0.8.5
unaffected
ea8377a596446291953dbe36e2d119d85bcd865b

Weaknesses (CWE)

CWE-915

CVSS v3.1 Details

CVSS v3.1 Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

References

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Start Training

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.

Scan Now