CVE-2026-45229 is a mass assignment vulnerability affecting Quark Drive's quark-auto-save component before version 0.8.5. The flaw exists in the POST /update endpoint where authenticated users can manipulate the config_data dictionary by posting arbitrary webui objects. Due to insufficient deny-list filtering, attackers can overwrite administrator credentials, resulting in permanent credential replacement and unauthorized persistent access to sensitive configurations including tasks, cloud tokens, and notification services. The vulnerability is remotely exploitable with low attack complexity and no user interaction required, leading to high impact on confidentiality, integrity, and availability.

Successful exploitation allows an authenticated attacker to overwrite administrator credentials, effectively locking out legitimate administrators. This leads to persistent unauthorized access to all configured tasks, cloud tokens, and notification services within the affected system. The impact affects confidentiality, integrity, and availability of the system's administrative functions and sensitive data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict authenticated user permissions to trusted personnel only and monitor for suspicious activity related to the POST /update endpoint. Avoid exposing this endpoint to untrusted networks. Follow vendor updates closely for any forthcoming patches or official mitigations.