CVE-2026-54367
HighCVSS 8.6Summary
CentreStack before 17.2 contains an authentication bypass vulnerability. An unauthenticated attacker can read, write, or delete arbitrary account settings by exploiting exposed API endpoints lacking authorization checks. Attackers can forge valid encrypted EntAcctId values using a static shared encryption key, enabling enumeration of tenant domains and administrator identities.
Risk Assessment
The risk is unauthorized access to account settings and sensitive data, potentially leading to information disclosure and privilege escalation.
Recommendation
Immediately upgrade CentreStack to version 17.2 or later, which includes a fix.
Other vulnerabilities in CentreStack
See all- CVE-2026-54368High
CentreStack before 17.4 contains a SQL injection vulnerability in GladDBFiles.SearchEx() and SearchExUnder(). An authenticated attacker can supply a crafted x-glad-filter header via the jsondir API endpoint, leading to arbitrary SQL execution and file writes using PostgreSQL functions, enabling remote code execution.
- CVE-2026-54366High
CentreStack before 17.4 contains an XML external entity (XXE) injection vulnerability. An unauthenticated attacker can supply a malicious URL to the SharePoint storage configuration handler, causing the server to fetch and parse attacker-controlled XML with external DTD references, leading to exfiltration of files such as Web.config containing database credentials and cryptographic keys.
- CVE-2026-54364Medium
CentreStack before version 17.4 contains a session variable injection vulnerability that allows unauthenticated attackers to inject arbitrary session variables by embedding newline and tab characters into a crafted AccountName parameter posted to the SelectProvider.aspx endpoint. Attackers can exploit the lack of input sanitization in the custom session serialization format to inject a resellerid session variable, bypassing the IsValidRSession authentication check and gaining unauthorized access to management pages.
- CVE-2026-54363Critical
CentreStack before version 17.5 contains a hardcoded cryptographic key vulnerability, allowing unauthenticated attackers to forge arbitrary encrypted tokens by exploiting a static SysNumber value used as entropy for AccessTicket.Encrypt() and AccessTicket.Decrypt(). Attackers can craft valid x-glad-auth headers and call privileged API endpoints such as acquiretenantbackuptoken to obtain a domain administrator IdentityTicket, enabling a complete unauthenticated remote code execution chain.
- CVE-2026-54365High
CentreStack before 17.3 contains an unauthenticated deserialization vulnerability in GSNamespace.dll. An unauthenticated attacker can supply a crafted base64-encoded XML string to exposed API endpoints, triggering creation of arbitrary local OS user accounts via the NetUserAdd Windows API.
Original NVD description (English source)
CentreStack before 17.2 contains an authentication bypass vulnerability that allows unauthenticated attackers to read, write, or delete arbitrary account settings by exploiting exposed API endpoints that lack authorization checks. Attackers can generate valid encrypted EntAcctId values using the static shared encryption key to forge identifiers for any user GUID, including the system-wide cluster settings account, enabling enumeration of hosted tenant domains and administrator identities.