Unauthorized Account Creation in Caddy Proxy Manager by Caddy

CVE-2026-54907

What is CVE-2026-54907?

Caddy Proxy Manager, a web interface for managing Caddy Server reverse proxies, allows unauthenticated remote actors to create accounts with the user role due to a default self-registration setting prior to version 1.5.1. This vulnerability enables attackers to create low-privilege accounts without requiring administrator approval. However, the impacted user role is unable to access or modify proxy data, limiting the overall risk. The issue has been addressed in version 1.5.1, which requires explicit configuration for self-registration to be enabled.

References