CVE-2026-79745

Name of the Vulnerable Software and Affected Versions MCPHub versions prior to 1.0.32

Description The built-in prompt and resource controllers lack role checking. The endpoints 'POST /api/prompts*' and 'PUT /api/prompts*', as well as 'POST /api/resources*' and 'PUT /api/resources*', are accessible to authenticated users without administrative privileges because the handlers do not verify the req.user variable. Since the DAO singletons are prioritized over connected MCP servers in the handleGetPromptRequest() and handleReadResourceRequest() functions, a non-admin user can create, overwrite, or shadow global prompt templates and resources. This leads to an unauthorized integrity violation and can result in stored prompt injection into the LLM sessions of other users.

Recommendations Update to version 1.0.32.