CVE-2026-54367 in CentreStack
Summary
by MITRE • 07/30/2026
CentreStack before 17.2 contains an authentication bypass vulnerability that allows unauthenticated attackers to read, write, or delete arbitrary account settings by exploiting exposed API endpoints that lack authorization checks. Attackers can generate valid encrypted EntAcctId values using the static shared encryption key to forge identifiers for any user GUID, including the system-wide cluster settings account, enabling enumeration of hosted tenant domains and administrator identities.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 07/30/2026
This vulnerability represents a critical authentication bypass flaw in CentreStack versions prior to 17.2 that fundamentally undermines the security posture of the platform through improper access control mechanisms. The issue stems from exposed API endpoints that fail to implement proper authorization checks, creating a pathway for unauthenticated attackers to perform arbitrary operations on account settings. The vulnerability manifests through the exploitation of static shared encryption keys that are hardcoded within the application, allowing malicious actors to generate valid encrypted EntAcctId values that can be used to forge identifiers for any user GUID. This cryptographic weakness directly maps to CWE-312 (Sensitive Data Exposure) and CWE-287 (Improper Authentication) while also aligning with ATT&CK technique T1078 (Valid Accounts) and T1566 (Phishing). The implications extend beyond simple unauthorized access as attackers can enumerate tenant domains and administrator identities, effectively creating a comprehensive reconnaissance capability that enables further attacks.
The technical execution of this vulnerability relies on the predictable nature of the static encryption key used throughout the system's authentication flow. When an attacker generates a valid encrypted EntAcctId value using this shared key, they can impersonate any user account within the system including high-privilege administrative accounts. This particular weakness creates a cascading effect where the initial bypass enables access to cluster-wide settings, which are typically protected by more stringent authorization controls. The vulnerability essentially allows attackers to traverse the system's permission model in ways that should be impossible under proper security design principles, exposing sensitive configuration data and potentially enabling complete system compromise.
The operational impact of this vulnerability is severe as it provides attackers with persistent access to critical system functions without requiring legitimate credentials or authentication tokens. Once exploited, attackers can modify account settings, delete user accounts, or extract sensitive information from the system's configuration databases. The enumeration capabilities introduced by this flaw allow threat actors to map out the entire tenant landscape, identifying which domains are hosted and potentially targeting specific administrative accounts for further exploitation. This vulnerability directly violates the principle of least privilege and demonstrates a fundamental failure in the application's authorization architecture. Organizations using affected versions face significant risk of data breaches, service disruption, and potential lateral movement within their network infrastructure.
Mitigation strategies should focus on immediate patching of CentreStack to version 17.2 or later where the authentication bypass vulnerability has been addressed through proper API endpoint authorization controls. System administrators must implement additional monitoring for unauthorized API access patterns and establish network segmentation to limit exposure of internal API endpoints. The static encryption key should be replaced with a dynamic key management solution that follows industry standards such as NIST SP 800-57 for cryptographic key management. Organizations should also conduct comprehensive security assessments to identify other hardcoded credentials or shared secrets within their infrastructure, as this vulnerability demonstrates the dangerous implications of using static keys for authentication purposes. Regular penetration testing and vulnerability scanning should be implemented to detect similar authorization bypass vulnerabilities in other applications and systems throughout the organization's attack surface.