CVE-2026-45229 - Vulnerability Analysis

Overview

Quark Drive < 0.8.5 contains a broken access control vulnerability caused by insufficient deny-list filtering in the POST /update endpoint, letting authenticated attackers overwrite administrator credentials and gain persistent access.

Severity & Score

Impact

Authenticated attackers can overwrite admin credentials, lock out legitimate users, and gain persistent full access to tasks, tokens, and notifications.

Mitigation

Update to version 0.8.5 or later.

References

• https://github.com/Cp0204/quark-auto-save/releases/tag/v0.8.5
• https://www.vulncheck.com/advisories/quark-drive-mass-assignment-via-post-update
• https://github.com/Cp0204/quark-auto-save/commit/ea8377a596446291953dbe36e2d119d85bcd865b

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner