High severity · published Jul 30, 2026
CVE-2026-54367
CentreStack < 17.2 Unauthenticated API Authorization Bypass
8.6
CVSS
0.3%
EPSS
No
On KEV
Description
CentreStack before 17.2 contains an authentication bypass vulnerability that allows unauthenticated attackers to read, write, or delete arbitrary account settings by exploiting exposed API endpoints that lack authorization checks. Attackers can generate valid encrypted EntAcctId values using the static shared encryption key to forge identifiers for any user GUID, including the system-wide cluster settings account, enabling enumeration of hosted tenant domains and administrator identities.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
High
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 25% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CE
CentreStack · Gladinet
before 17.2 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-54367
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-54367
www.centrestack.com
https://www.centrestack.com/
www.vulncheck.com
https://www.vulncheck.com/advisories/centrestack-unauthenticated-api-authorization-bypass
More from CentreStack
9.8
CVE-2025-14611
Gladinet CentreStack and TrioFox Hard Coded AES Keys
9.8
CVE-2025-30406
Gladinet CentreStack and Triofox Use of Hard-coded Cryptographic Key Vulnerability
7.5
CVE-2025-11371
Gladinet CentreStack and TrioFox Local File Inclusion Flaw
9.8
CVE-2023-26829
An authentication bypass vulnerability in the Password Reset component of Gladinet CentreStack before 13.5.9808 allows remote attackers to set a new password for any valid user…
9.1
CVE-2026-54363
CentreStack < 17.5 Hardcoded Key Token Forgery RCE