Mass Assignment Vulnerability in Quark Drive by Cp0204

CVE-2026-45229

What is CVE-2026-45229?

Quark Drive prior to version 0.8.5 is vulnerable to a mass assignment flaw that allows authenticated attackers to overwrite administrator credentials. By exploiting the POST /update endpoint, attackers can inject arbitrary data into the config_data dictionary, bypassing insufficient deny-list filtering. This can lead to unauthorized access by permanently replacing legitimate administrator login information, effectively locking out the rightful administrators. As a result, attackers can gain persistent access to all tasks, cloud tokens, and notification services configured within the application.

References