CVE-2026-54367: fallo de gravedad alta en Gladinet CentreStack
CentreStack < 17.2 Unauthenticated API Authorization Bypass
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
21Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 8.8epss 0.3%
CentreStack before 17.2 contains an authentication bypass vulnerability that allows unauthenticated attackers to read, write, or delete arbitrary account settings by exploiting exposed API endpoints that lack authorization checks. Attackers can generate valid encrypted EntAcctId values using the static shared encryption key to forge identifiers for any user GUID, including the system-wide cluster settings account, enabling enumeration of hosted tenant domains and administrator identities.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N
Productos afectados
Gladinet · CentreStackCVEs relacionadas — Gladinet CentreStack
En el mismo producto, de las más peligrosas a las menos.
CVE-2025-30406CRITICALCVE-2025-30406EPSS 94.3%KEVCVE-2026-54368HIGHCentreStack < 17.4 SQL Injection via x-glad-filter HeaderEPSS 0.7%CVE-2026-54363CRITICALCentreStack < 17.5 Hardcoded Key Token Forgery RCEEPSS 0.7%CVE-2026-54366HIGHCentreStack < 17.4 XXE via SharePoint Storage ConfigurationEPSS 0.5%CVE-2026-54364MEDIUMCentreStack < 17.4 Session Injection via SelectProvider.aspxEPSS 0.4%CVE-2026-54365HIGHCentreStack < 17.3 Unauthenticated User Creation via Deserialization in GSNamespace.dllEPSS 0.4%