The flaw lies in Quark Drive versions older than 0.8.5, where the POST /update endpoint accepts an arbitrary webui object into the config_data dictionary without proper whitelist checks. An authenticated attacker can craft this payload to overwrite existing administrator credentials, lock out legitimate admins, and persistently control configured tasks, cloud tokens, and notifications. This mass assignment vulnerability (CWE‑915) undermines confidentiality, integrity, and availability of the administration functions.

Affected installations belong to the Cp0204 quark-auto‑save product. All users running a version before 0.8.5 are vulnerable; the advisory indicates that v0.8.5 is the first release that addresses the flaw. The type of configuration change is beyond sub‑versions, so any earlier release is at risk.

The CVSS base score of 8.7 signals a high‑severity risk that permits loss of admin control. EPSS information is not available, but the exploit requires only local or remote authenticated access to the application’s update interface, meaning it could be abused wherever users can reach the service. The flaw is not listed in the CISA KEV catalog, suggesting no widely known public exploitation yet. Nonetheless, an attacker who can authenticate can rewrite credentials, enabling persistence and executing scheduled tasks without detection.