| शीर्षक | mcphub <= v1.0.28 Improper Privilege Management |
|---|
| विवरण | Summary
MCPHub's PUT /api/system-config endpoint (handler updateSystemConfig) performs no authorization check. It is protected only by the app-wide authentication middleware and a rate limiter — it never inspects req.user.isAdmin. The global systemConfig it mutates governs the instance's entire security posture, and comparable global-state routes are admin-only (the docs list /api/oauth/clients CRUD as "Admin-only", and userController gates every handler with requireAdmin). The missing gate on updateSystemConfig lets any authenticated non-admin user rewrite that global security configuration — a privilege boundary the product otherwise enforces.
The vulnerability is the missing authorization, not the behavior of any individual setting. routing.skipAuth granting an unauthenticated guest administrator is documented, intended behavior for trusted environments (docs/api-reference/config.mdx, docs/development/architecture.mdx); the flaw is that a non-admin can enable it — and rewrite other security-relevant fields — because the endpoint that writes them lacks an admin check. This is a single-request self-escalation from a non-admin account to control of the global config. |
|---|
| स्रोत | ⚠️ https://github.com/samanhappy/mcphub/security/advisories/GHSA-4gc8-885f-qj36 |
|---|
| उपयोगकर्ता | wshi.24 (UID 98607) |
|---|
| सबमिशन | 17/08/2026 08:26 AM (2 महीनों पहले) |
|---|
| संयम | 15/09/2026 10:46 AM (29 days later) |
|---|
| स्थिति | प्रतिलिपि |
|---|
| VulDB प्रविष्टि | 397400 [samanhappy MCPHub तक 1.0.28 Authorization Check /api/system-config updateSystemConfig isAdmin अधिकार वृद्धि] |
|---|
| अंक | 0 |
|---|