CVE-2026-45229 is a mass assignment vulnerability in the quark-auto-save product (Quark Drive) prior to version 0.8.5. The vulnerability exists in the POST /update endpoint, where authenticated attackers can submit arbitrary webui objects to the config_data dictionary due to insufficient deny-list filtering. This flaw enables attackers to overwrite administrator credentials, resulting in permanent credential replacement, administrator lockout, and persistent unauthorized access to all configured tasks, cloud tokens, and notification services within the affected system.

Successful exploitation allows an authenticated attacker to overwrite administrator credentials, effectively locking out legitimate administrators. The attacker gains persistent access to all configured tasks, cloud tokens, and notification services, potentially compromising the entire system's security and operations.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the POST /update endpoint to trusted users only and monitor for suspicious activity related to configuration changes. Avoid using vulnerable versions and upgrade once a patch is released.