The vulnerability exists because the Remote Instances proxy API does not enforce authentication for incoming requests. This enables an unauthenticated attacker to send arbitrary API calls to a remotely configured MWDB instance using the configured API key, thereby performing actions with the identity and permissions of that key. The result is that the attacker can read, modify, or create data, or otherwise execute any operation permitted to the key holder within the instance. The weakness is classified as CWE‑862: Missing Authorization.

The issue affects MWDB Core versions from 2.2.0 up to, but not including, 2.19.0, deployed by CERT.PL. It only manifests on installations where the Remote Instances feature has been set up and an API key has been provisioned for remote calls.

With a CVSS score of 7 the vulnerability is moderate to high severity. The EPSS score of less than 1% suggests that statistically few exploit attempts are expected, and it is not listed in the CISA KEV catalog. However, if an attacker gains network access to an instance with Remote Instances enabled, the missing authentication allows exploitation without any further credentials. Mitigation involves updating the software; otherwise disabling Remote Instances or rotating the associated API key mitigates the risk.