| Title | mcphub <= v1.0.28 Improper Privilege Management |
|---|
| Description | Summary
MCPHub's PUT /api/system-config endpoint (handler updateSystemConfig) performs no authorization check. It is protected only by the app-wide authentication middleware and a rate limiter — it never inspects req.user.isAdmin. The global systemConfig it mutates governs the instance's entire security posture, and comparable global-state routes are admin-only (the docs list /api/oauth/clients CRUD as "Admin-only", and userController gates every handler with requireAdmin). The missing gate on updateSystemConfig lets any authenticated non-admin user rewrite that global security configuration — a privilege boundary the product otherwise enforces.
The vulnerability is the missing authorization, not the behavior of any individual setting. routing.skipAuth granting an unauthenticated guest administrator is documented, intended behavior for trusted environments (docs/api-reference/config.mdx, docs/development/architecture.mdx); the flaw is that a non-admin can enable it — and rewrite other security-relevant fields — because the endpoint that writes them lacks an admin check. This is a single-request self-escalation from a non-admin account to control of the global config. |
|---|
| Source | ⚠️ https://github.com/samanhappy/mcphub/security/advisories/GHSA-4gc8-885f-qj36 |
|---|
| User | wshi.24 (UID 98607) |
|---|
| Submission | 08/17/2026 08:26 (29 days ago) |
|---|
| Moderation | 09/15/2026 10:46 (29 days later) |
|---|
| Status | Duplicate |
|---|
| VulDB entry | 397400 [samanhappy MCPHub up to 1.0.28 Authorization Check /api/system-config updateSystemConfig isAdmin improper authorization] |
|---|
| Points | 0 |
|---|