CVE-2026-66724 is a missing authorization vulnerability in MWDB Core versions >=2.0.0 and <2.19.0. The issue allows any authenticated user without the adding_configs or adding_blobs capabilities to upload config and text blob objects to the system via undocumented POST method in deprecated config and blob upload endpoints. This vulnerability has a significant impact on the security of MWDB Core instances, [truncated]
CVE-2026-66723 debrief based on the supplied source corpus. MWDB Core versions >=2.2.0 and <2.19.0 contain a missing authorization vulnerability in the Remote Instances proxy API. The proxy API does not verify authentication for incoming requests, allowing an unauthenticated remote attacker to send arbitrary requests to a remote MWDB instance using the identity and permissions associated with the configur [truncated]
