CVE-2026-45229 Quark Drive (quark-auto-save) < 0.8.5 Mass Assignment via POST /update
Authenticated attackers can overwrite administrator credentials via mass assignment in the update endpoint, gaining persistent access and locking out legitimate admins.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-45229?
CVE-2026-45229 is a high-severity missing authorization vulnerability in Cp0204 quark-auto-save, published on 13 May 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Quark Drive before 0.8.5 contains a mass assignment vulnerability in the POST /update endpoint that allows authenticated attackers to overwrite administrator credentials by posting an arbitrary webui object to the config_data dictionary. Attackers can exploit insufficient deny-list filtering to permanently replace stored login credentials, lock out legitimate administrators, and gain persistent access to all configured tasks, cloud tokens, and notification services.
Weakness: CWE-915
Which versions are affected by CVE-2026-45229?
How do I fix CVE-2026-45229?
No fix has been published for CVE-2026-45229 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-45229 being exploited?
There is no known exploitation of CVE-2026-45229 in the wild and no public exploit code.
Sources
Also known as GHSA-x5vh-96v7-w3ph.