Authentication Bypass Vulnerability in CentreStack by CentreStack
CVE-2026-54367

8.8HIGH

Key Information:

Vendor

Gladinet

Status
Centrestack
Vendor
CVE Published:
30 July 2026

What is CVE-2026-54367?

CentreStack versions prior to 17.2 contain a vulnerability that allows unauthenticated attackers to access sensitive account settings via exposed API endpoints. By bypassing necessary authorization checks, attackers can read, write, or delete settings for any user account, including those of administrators. This vulnerability permits the crafting of modified identifiers using a static shared encryption key, enabling attackers to enumerate hosted tenant domains and gain unauthorized insights into system-wide configurations.

Affected Version(s)

CentreStack 0

References

https://www.centrestack.com/
product
https://www.vulncheck.com/advisories/centrestack-unauthen...
third-party-advisory

CVSS V4

Score:
8.8
Severity:
HIGH
Confidentiality:
Low
Integrity:
High
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

PeterV @cfc security ltd
.