Skip to content
CVE PROGRAM SOURCE RECORD8.7 High

CVE-2026-45229

Quark Drive (quark-auto-save) < 0.8.5 Mass Assignment via POST /update

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
VulnCheck

Description

Quark Drive before 0.8.5 contains a mass assignment vulnerability in the POST /update endpoint that allows authenticated attackers to overwrite administrator credentials by posting an arbitrary webui object to the config_data dictionary. Attackers can exploit insufficient deny-list filtering to permanently replace stored login credentials, lock out legitimate administrators, and gain persistent access to all configured tasks, cloud tokens, and notification services.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Cp0204 quark-auto-save

Default version status: affected

  • 0 to < 0.8.5affected
  • ea8377a596446291953dbe36e2d119d85bcd865bunaffected
pkg:github/Cp0204/quark-auto-save

References