CVE-2026-66723
Last modified
CVE-2026-66723 is a high-severity vulnerability rated 7/10 on the CVSS scale. MWDB Core versions >=2.2.0 and <2.19.0 contain a missing authorization vulnerability in the Remote Instances proxy API. The proxy API does not verify authentication for incoming requests, allowing an unauthenticated remote attacker to send arbitrary requests to a remote MWDB instance using the identity and permissions associated with the configured API key. EPSS estimates a 0.49% chance of exploitation in the next 30 days.
Description
MWDB Core versions >=2.2.0 and <2.19.0 contain a missing authorization vulnerability in the Remote Instances proxy API. The proxy API does not verify authentication for incoming requests, allowing an unauthenticated remote attacker to send arbitrary requests to a remote MWDB instance using the identity and permissions associated with the configured API key. This can result in unauthorized actions being performed on the remote instance as if executed by the user whose API key was used to set up the remote instance. The vulnerability is limited to deployments where Remote Instances have been configured.This issue has been fixed in version 2.19.0
Metrics
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| CERT.PL | MWDB Core | >= 2.2.0, < 2.19.0 |
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2026-66723?
How severe is CVE-2026-66723?
How do I fix CVE-2026-66723?
How Strix Helps
- Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-66710Unauthenticated Local File Inclusion in e2pdf <= 1.32.40 ver…8.1
- CVE-2026-66711Subscriber Cross Site Scripting (XSS) in WooCommerce Multili…7.1
- CVE-2026-66712Unauthenticated Broken Access Control in Simple Membership <…7.5
- CVE-2026-66713Deserialization of Untrusted Data (CWE-502) in the Tribes-ba…9.8
- CVE-2026-6672The Affiliate Program Suite — SliceWP Affiliates plugin for …6.4
- CVE-2026-66720The GOOSE subscriber component improperly validates the UTC …7.1
- CVE-2026-66724MWDB Core versions >=2.0.0 and <2.19.0 contain a missing aut…5.3
- CVE-2026-66729facil.io 0.6.0 through 0.7.6 contains an integer underflow v…8.7
- CVE-2026-6673Mattermost versions 11.7.x <= 11.7.0, 11.6.x <= 11.6.2, 11.5…6.4
- CVE-2026-66730facil.io 0.6.0 through 0.7.6 contains a denial-of-service vu…8.7
- CVE-2026-66731facil.io 0.7.5 through 0.7.6 contains a denial-of-service vu…8.7
- CVE-2026-66732Sonic 3 A.I.R. before commit 2492d18 contains a missing sour…8.3
Are you affected by CVE-2026-66723?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST