CVE-2026-45229 Details

A mass assignment vulnerability has been identified in Quark Drive versions prior to 0.8.5. This vulnerability exists in the POST /update endpoint, where authenticated attackers can overwrite administrator credentials. By posting an arbitrary webui object to the config_data dictionary, attackers exploit inadequate deny-list filtering to permanently replace stored login credentials. This action can lock out legitimate administrators and provide persistent access to all configured tasks, cloud tokens, and notification services.

Users can update to Quark Drive version 0.8.6 or later, where this vulnerability has been patched.