What’s Vulnerable › Vulnerabilities

CVE-2026-54367: CentreStack < 17.2 Unauthenticated API Authorization Bypass

• Severity: high (CVSS 8.6 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-07-30 · updated 2026-10-23
• Weakness: CWE-306

Description

CentreStack before 17.2 contains an authentication bypass vulnerability that allows unauthenticated attackers to read, write, or delete arbitrary account settings by exploiting exposed API endpoints that lack authorization checks. Attackers can generate valid encrypted EntAcctId values using the static shared encryption key to forge identifiers for any user GUID, including the system-wide cluster settings account, enabling enumeration of hosted tenant domains and administrator identities.

Affected products

• Gladinet CentreStack: before 17.2 — fixed in 17.2

How to fix

Upgrade to a fixed version: Gladinet CentreStack 17.2. Check the vendor advisory for mitigations.

References

• https://www.centrestack.com/
• https://www.vulncheck.com/advisories/centrestack-unauthenticated-api-authorization-bypass

Get alerted when CVE-2026-54367 or the next vulnerability affects your stack