Cve-2026-54367 - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/tags/cve-2026-54367/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioThu, 30 Jul 2026 13:41:11 +0000Authentication Bypass Vulnerability in CentreStackhttps://feed.craftedsignal.io/briefs/2026-07-centrestack-auth-bypass/Thu, 30 Jul 2026 13:41:11 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-07-centrestack-auth-bypass/CentreStack versions prior to 17.2 are vulnerable to an authentication bypass that allows unauthenticated attackers to manipulate account settings and enumerate system data via exposed API endpoints.CentreStack versions prior to 17.2 contain a critical authentication bypass vulnerability (CVE-2026-54367) originating from exposed API endpoints that fail to enforce necessary authorization checks. By leveraging a static shared encryption key, an unauthenticated attacker can generate valid, encrypted EntAcctId values. These values allow the attacker to forge identifiers for any user GUID, including those associated with system-wide cluster settings. Successful exploitation permits an attacker to perform unauthorized read, write, and delete operations on arbitrary account settings, and provides the capability to enumerate hosted tenant domains and administrative identities. This flaw poses a significant risk to organizations relying on CentreStack for managed file services, as it enables deep unauthorized access to the platform configuration and user data structures.

Impact

Successful exploitation of this vulnerability allows unauthenticated attackers to gain administrative-level visibility and control over the platform's account settings. This leads to the exposure of sensitive organizational tenant information, potential account takeover of administrative roles, and the ability to modify core system configurations. The compromise of tenant enumeration and administrative identity metadata significantly increases the risk of further targeted attacks against the organization's infrastructure.

Recommendation

  • Upgrade all CentreStack deployments to version 17.2 or later immediately to remediate CVE-2026-54367.
  • Review web server access logs for anomalous, high-frequency POST or GET requests targeting API endpoints associated with user or cluster setting management.
  • Perform a security audit of current administrative accounts to ensure no unauthorized identities or modified settings were introduced while the system was unpatched.
]]>highadvisoryauthentication-bypasscve-2026-54367api-security