# CVE-2026-79744: MCPHub missing authorization on PUT /api/system-config

Source: https://junglewise.ai/threats/cve-2026-79744-mcphub-missing-authorization-on-put-api-system-config  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-31. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-79744 · Severity: high · CVSS 8.8 · Published 2026-08-31

MCPHub is a server management hub that centralizes configuration for multiple API endpoints. The PUT /api/system-config endpoint lacks proper access controls, allowing any authenticated user—even non-administrators—to rewrite critical global security settings. An attacker could enable guest authentication bypass, alter OAuth configuration, or redirect API traffic to malicious servers, compromising the entire instance's security posture.

Technologies: [Samanhappy Mcphub](https://junglewise.ai/threats/technologies/mcphub). Vendors: [Samanhappy](https://junglewise.ai/threats/vendors/samanhappy).

## Quick answers

**Is CVE-2026-79744 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-79744 being exploited in the wild.

**How severe is CVE-2026-79744?** High severity, with a CVSS score of 8.8, published 31 August 2026.

**Which products and versions are affected?** Samanhappy Mcphub <= 1.0.28.

**Is there a fix for CVE-2026-79744?** A patch was published on 2026-08-17: Version 1.0.29 released with authorization check added Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-79744 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-79744?** Check whether you run Samanhappy Mcphub at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a missing authorization check on the PUT /api/system-config endpoint (updateSystemConfig handler). While the endpoint is protected by app-wide authentication middleware, it never verifies the req.user.isAdmin property before accepting configuration updates. The handler destructures fields directly from req.body and merges them into the persisted systemConfig without any role-based access control. An authenticated non-admin user can single-handedly enable routing.skipAuth=true to bypass authentication globally, rewrite OAuth settings, redirect smartRouting.openaiApiBaseUrl for supply-chain attacks, or weaken other security-relevant fields. The vulnerability is patched in version 1.0.29 by adding an admin authorization gate.

## Affected products

- samanhappy MCPHub <= 1.0.28

## Timeline

- 2026-08-17: disclosed
- 2026-08-17: patched: Version 1.0.29 released with authorization check added

## References

- [https://github.com/samanhappy/mcphub/releases/tag/v1.0.29](https://github.com/samanhappy/mcphub/releases/tag/v1.0.29)
- [https://github.com/samanhappy/mcphub/security/advisories/GHSA-4gc8-885f-qj36](https://github.com/samanhappy/mcphub/security/advisories/GHSA-4gc8-885f-qj36)

## Related threats

- [samanhappy MCPHub credential exfiltration via passthroughHeaders](https://junglewise.ai/threats/cve-2026-120323-a-security-flaw-has-been-discovered-in-samanhappy-mcphub-up-to-1)
- [samanhappy MCPHub privilege management in template import](https://junglewise.ai/threats/cve-2026-94047-a-security-vulnerability-has-been-detected-in-samanhappy-mcphub)
- [MCPHub OAuth 2.0 authentication bypass in authorization server](https://junglewise.ai/threats/cve-2026-90474-mcphub-oauth-2-0-authentication-bypass-in-authorization-server)
- [MCPHub horizontal privilege escalation in tool execution API](https://junglewise.ai/threats/cve-2026-79750-mcphub-horizontal-privilege-escalation-in-tool-execution-api)
- [MCPHub SSRF guard bypass in IPv6 transition address handling](https://junglewise.ai/threats/cve-2026-79749-mcphub-ssrf-guard-bypass-in-ipv6-transition-address-handling)