CVE-2026-79744

Name of the Vulnerable Software and Affected Versions MCPHub versions prior to 1.0.29

Description The PUT '/api/system-config' endpoint (handler updateSystemConfig) lacks an authorization check. While the endpoint is protected by authentication middleware and a rate limiter, it fails to verify if the user has administrative privileges by not inspecting the req.user.isAdmin variable.

Recommendations Update to version 1.0.29.