MWDB Core versions from 2.0.0 through 2.18.x contain a missing authorization flaw in the deprecated config and blob upload endpoints. These endpoints accept an undocumented POST HTTP method, which bypasses the capability checks implemented for the documented PUT method. Consequently, any authenticated user lacking the adding_configs or adding_blobs privileges can upload arbitrary configuration and text blob objects to the system. The flaw does not grant code execution or remote control, but it enables an attacker to alter system behavior or persist malicious artifacts by manipulating configuration data.

The vulnerability affects MWDB Core software distributed by CERT.PL. Any installation running a version between 2.0.0 inclusive and 2.19.0 exclusive (i.e., the 2.x release series) is impacted. The issue was fixed in release 2.19.0, which enforces proper authorization on all accepted HTTP methods.

The CVSS score is 5.3, indicating moderate severity. The EPSS score is reported as less than 1%, suggesting a very low exploitation probability at present. The vulnerability is not listed in the CISA KEV catalog. An attacker must first authenticate to the MWDB Core service and then perform an HTTP POST to the config or blob upload endpoint. Because the flaw bypasses the intended capability checks, no additional privileges are required beyond a valid account, making the threat vector likely to be network‑based internal or externally accessible services with authentication enabled. The impact is limited to the creation of new configuration or blob objects, which could enable subtle persistence or trigger unintended system behavior if the uploaded content is malicious.