CVE-2026-54907

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-54907

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-54907.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-54907

Aliases

GHSA-4wcc-gwxr-gc9p

Published

2026-09-17T20:32:19Z

Modified

2026-09-19T11:31:02Z

Severity

5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N CVSS Calculator

Summary

Caddy Proxy Manager: Registrations enabled by default allows creating users with "user" permission

Details

Caddy Proxy Manager is a web interface for managing Caddy Server reverse proxies and certificates. Prior to 1.5.1, Caddy Proxy Manager enables email and password self-registration by default at /api/auth/sign-up/email, allowing an unauthenticated remote actor to create an active account with the user role without administrator approval. The user role cannot view or modify proxy data, so the direct impact is limited to unauthorized creation of low-privilege accounts. The fixed configuration in src/lib/config.ts and src/lib/auth-server.ts requires AUTH_ALLOW_SELF_REGISTRATION=true before the authentication library's disableSignUp control permits sign-up. This issue is fixed in version 1.5.1.

Database specific

{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-1188"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54907.json"
}

References

Affected packages

Git / github.com/fuomag9/caddy-proxy-manager

Affected ranges

Type

GIT

Repo

https://github.com/fuomag9/caddy-proxy-manager

Events

Introduced

Fixed

ed6d04f0d80a9c4c234e83e11af6fe635ce117cc

Database specific

Show details

{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "1.5.1"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

1.*

1.0

v1.*

v1.0

v1.0-RC

v1.0-rc1

v1.0-rc2

v1.0-rc3

v1.0-rc4

v1.0.1

v1.1

v1.2

v1.3

v1.4

v1.5

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-54907.json"