samanhappy MCPHub up to 1.0.28 Authorization Check /api/system-config updateSystemConfig isAdmin improper authorization

Summaryinfo

A vulnerability labeled as critical has been found in samanhappy MCPHub up to 1.0.28. This vulnerability affects the function updateSystemConfig of the file /api/system-config of the component Authorization Check. Such manipulation of the argument isAdmin leads to improper authorization. This vulnerability is referenced as CVE-2026-79744. It is possible to launch the attack remotely. No exploit is available.

Detailsinfo

A vulnerability was found in samanhappy MCPHub up to 1.0.28 and classified as critical. Affected by this issue is the function updateSystemConfig of the file /api/system-config of the component Authorization Check. The manipulation of the argument isAdmin with an unknown input leads to a improper authorization vulnerability. Using CWE to declare the problem leads to CWE-285. The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action. Impacted is confidentiality, integrity, and availability. CVE summarizes:

MCPHub is a unified hub for centrally managing and dynamically orchestrating multiple MCP servers/APIs into separate endpoints with flexible routing strategies. Prior to version 1.0.29, MCPHub's PUT /api/system-config endpoint (handler updateSystemConfig) performs no authorization check. It is protected only by the app-wide authentication middleware and a rate limiter — it never inspects req.user.isAdmin. This issue has been patched in version 1.0.29.

The advisory is shared for download at github.com. This vulnerability is handled as CVE-2026-79744 since 08/25/2026. The exploitation is known to be easy. The attack may be launched remotely. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1548.002.

Upgrading to version 1.0.29 eliminates this vulnerability.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Vendor

• samanhappy

Name

• MCPHub

Version

• 1.0.0
• 1.0.1
• 1.0.2
• 1.0.3
• 1.0.4
• 1.0.5
• 1.0.6
• 1.0.7
• 1.0.8
• 1.0.9
• 1.0.10
• 1.0.11
• 1.0.12
• 1.0.13
• 1.0.14
• 1.0.15
• 1.0.16
• 1.0.17
• 1.0.18
• 1.0.19
• 1.0.20
• 1.0.21
• 1.0.22
• 1.0.23
• 1.0.24
• 1.0.25
• 1.0.26
• 1.0.27
• 1.0.28

Website

• Product: https://github.com/samanhappy/mcphub/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion