Vulnerability Intelligence Report
CentreStack < 17.2 Unauthenticated API Authorization Bypass
CVE-2026-54367
CentreStack before 17.2 contains an authentication bypass vulnerability that allows unauthenticated attackers to read, write, or delete arbitrary account settings by exploiting exposed API endpoints that lack authorization checks. Attackers can generate valid encrypted EntAcctId values using the static shared encryption key to forge identifiers for any user GUID, including the system-wide cluster settings account, enabling enumeration of hosted tenant domains and administrator identities.
No Active Exploit Signals
CVSS Base Score
8.8
HIGH
EPSS Probability:0.19%
Executive Threat Verdict
Evaluating...
Evaluating Threat Landscape...
Assessing known weaponization, exploitation telemetry, and federal advisories.
Attack Surface
—
Authentication
—
Weaponization
—
SSVC Action
—
Weaknesses (CWE)
CWE-306 ↗Missing Authentication for Critical Function
Affected Products & Versions
| Vendor | Product | Affected Versions |
|---|---|---|
| Gladinet | CentreStack | 0 < 17.2 (affected) |
References & Technical Advisories
No reference links found.
Threat Intelligence Signals
EPSS Score
0.188%
GitHub Advisory
Identity & Timeline
| Status | PUBLISHED |
| Assigning Authority | VulnCheck · Bug Bounty Provider · USA |
| Reserved | 2026-06-12T20:20:02 |
| Published | 2026-07-30T12:26:11 |
| Patch Date | 2026-07-28 |
| Last Updated | 2026-08-14T16:50:21 |
Community Chatter & Buzz