CVE-2026-45229: Mass Assignment in Quark Drive
Platform
nodejs
Component
quark-auto-save
Fixed in
0.8.5
CVE-2026-45229 describes a mass assignment vulnerability discovered in Quark Drive. This flaw allows authenticated attackers to manipulate administrator credentials by exploiting insufficient input validation within the /update endpoint. The vulnerability impacts versions prior to 0.8.5 and can result in unauthorized access and control over the system. A patch is available in version 0.8.5.
Impact and Attack Scenarios
The core impact of CVE-2026-45229 lies in the ability for an attacker to permanently compromise administrator accounts. By crafting a malicious POST request to the /update endpoint, an attacker can overwrite the stored login credentials. This effectively locks out legitimate administrators and grants the attacker persistent, unauthorized access to the entire Quark Drive instance. This access extends to all configured tasks, cloud tokens, and notification services, potentially enabling widespread disruption and data exfiltration. The vulnerability's reliance on authentication means an attacker must first gain a valid login, but once achieved, the impact is severe and long-lasting.
Exploitation Context
CVE-2026-45229 was published on 2026-05-13. Its severity is rated HIGH with a CVSS score of 8.8. There are currently no publicly known Proof-of-Concept (POC) exploits. The vulnerability is not listed on KEV or EPSS, suggesting a low to medium probability of active exploitation at this time. Monitor vendor advisories and security mailing lists for updates.
Threat Intelligence
Exploit Status
CVSS Vector
What do these metrics mean?
- Attack Vector
- Network — remotely exploitable over the internet. No physical or local access required. Widest attack surface.
- Attack Complexity
- Low — no special conditions required. Attacker can exploit reliably without depending on rare configurations or timing.
- Privileges Required
- Low — any valid user account is sufficient. Basic authenticated access required.
- User Interaction
- None — attack is automatic and silent. Victim does nothing: no click, no file open.
- Scope
- Unchanged — impact is limited to the vulnerable component itself.
- Confidentiality
- High — complete confidentiality loss. Attacker can read all data: credentials, keys, personal data.
- Integrity
- High — attacker can write, modify, or delete any data: databases, config files, or code.
- Availability
- High — complete crash or resource exhaustion. Full denial of service.
Affected Software
Weakness Classification (CWE)
Timeline
- Reserved
- Published
Mitigation and Workarounds
The primary mitigation for CVE-2026-45229 is to immediately upgrade Quark Drive to version 0.8.5 or later. If an upgrade is not immediately feasible, consider implementing a Web Application Firewall (WAF) rule to block POST requests to the /update endpoint containing arbitrary webui objects within the config_data dictionary. Alternatively, restrict access to the /update endpoint to trusted networks or users. Carefully review and validate all input received by the /update endpoint to prevent future mass assignment vulnerabilities. After upgrading, confirm the fix by attempting to modify administrator credentials via the /update endpoint with a crafted payload; the request should be rejected.
How to fix
Actualice Quark Drive a la versión 0.8.5 o superior para mitigar la vulnerabilidad de asignación masiva. Esta actualización corrige la falta de filtrado adecuado en la lista de denegación, previniendo que atacantes puedan sobrescribir las credenciales del administrador.
Frequently asked questions
What is CVE-2026-45229 — mass assignment in Quark Drive?
CVE-2026-45229 is a HIGH severity vulnerability in Quark Drive allowing authenticated attackers to overwrite administrator credentials via the /update endpoint, leading to persistent access and control.
Am I affected by CVE-2026-45229 in Quark Drive?
You are affected if you are running Quark Drive versions 0.0.0–ea8377a596446291953dbe36e2d119d85bcd865b and have not upgraded to version 0.8.5.
How do I fix CVE-2026-45229 in Quark Drive?
Upgrade Quark Drive to version 0.8.5 or later. As a temporary workaround, implement a WAF rule to block malicious POST requests to the /update endpoint.
Is CVE-2026-45229 being actively exploited?
Currently, there are no publicly known Proof-of-Concept exploits or reports of active exploitation, but vigilance is advised.
Where can I find the official Quark Drive advisory for CVE-2026-45229?
Refer to the Quark Drive official website and security advisories for the latest information and updates regarding CVE-2026-45229.
Is your project affected?
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.
Try it now — no account
Upload any manifest (composer.lock, package-lock.json, WordPress plugin list…) or paste your component list. You get a vulnerability report instantly. Uploading a file is just the start: with an account you get continuous monitoring, Slack/email alerts, multi-project and white-label reports.
Drag & drop your dependency file
composer.lock, package-lock.json, requirements.txt, Gemfile.lock, pubspec.lock, Dockerfile...