Improper Authorization in Zipline API Affects User Registration
CVE-2024-58405

8.8HIGH

Key Information:

Vendor

Diced

Status
Zipline
Vendor
CVE Published:
13 November 2026

What is CVE-2024-58405?

The Zipline product version 3.7.9 contains a significant vulnerability in its /api/auth/register endpoint, allowing unauthenticated attackers to exploit improper authorization. When both invite codes and user registration are enabled, the system should enforce use of an invite code to create an account; however, if registration is disabled, this check is bypassed. Attackers can send a direct POST request without an invite code, successfully creating accounts, accessing sensitive stats, and potentially consuming storage by uploading numerous files.

Affected Version(s)

zipline 0 <= 3.7.9

References

https://github.com/diced/zipline/security/advisories/GHSA...
vendor-advisory
https://www.vulncheck.com/advisories/zipline-through-3.7....
third-party-advisory

CVSS V4

Score:
8.8
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

resetd3v
.