Security readout for executives and security teams
Plain-English summary
Quark Drive’s quark-auto-save before 0.8.5 lets a logged-in attacker change stored administrator login settings through the update endpoint. That can lock out legitimate administrators and give the attacker lasting access to configured tasks, cloud tokens, and notification services. Exposure is highest where the web UI is reachable by untrusted users or shared accounts.
Executive priority
Treat this as a high-priority credential and token exposure issue for affected deployments. Patch quickly, limit web UI access, and investigate any signs of administrator lockout or unexpected configuration changes.
Technical view
CVE-2026-45229 is a CWE-915 mass assignment flaw in POST /update. Insufficient deny-list filtering allows an authenticated attacker to post an arbitrary webui object into config_data, replacing stored administrator credentials. The CVSS 3.1 score is 8.8 with network access, low complexity, low privileges, no user interaction, and high confidentiality, integrity, and availability impact.
Likely exposure
Systems running Cp0204 quark-auto-save before version 0.8.5 are affected. Exposure requires an authenticated attacker and network reachability to the web UI update endpoint.
Exploitation context
The CVE bundle does not cite CISA KEV listing or active exploitation. Public sources describe a practical authenticated attack path that can persistently replace administrator credentials and expose configured tasks, cloud tokens, and notification services.
Researcher notes
The key issue is mass assignment into config_data via POST /update, not unauthenticated access. Analysis should focus on whether deny-list filtering was bypassable before 0.8.5 and whether stored webui credentials or linked service tokens were changed.
Mitigation direction
- Upgrade quark-auto-save to version 0.8.5 or later.
- Review the v0.8.5 release notes and patch commit for vendor guidance.
- Restrict web UI access to trusted networks and trusted accounts.
- Rotate administrator credentials if unauthorized configuration changes are suspected.
- Rotate cloud tokens and notification service secrets after suspected compromise.
Validation and detection
- Inventory all quark-auto-save deployments and record running versions.
- Confirm each deployment is version 0.8.5 or later.
- Review configuration history for unexpected webui or credential changes.
- Review access logs for suspicious authenticated POST /update activity.
- Check configured cloud tokens and notification services for unauthorized use.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-915: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2026-45229 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
2 official scoresWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H2.85.9VulnCheckCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N——VulnCheckVulnerability scoring details
Base CVSS 4.0 score
8.7HighVector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Base CVSS 3.1 score
8.8HighVector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/Cp0204/quark-auto-save/releases/tag/v0.8.5CVE reference, VulnCheck · release-notes
- https://github.com/Cp0204/quark-auto-save/commit/ea8377a596446291953dbe36e2d119d85bcd865bCVE reference, VulnCheck · patch
- https://www.vulncheck.com/advisories/quark-drive-mass-assignment-via-post-updateCVE reference, VulnCheck · third-party-advisory
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improperly Controlled Modification of Dynamically-Determined Object Attributes
Improperly Controlled Modification of Dynamically-Determined Object Attributes represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.