CVE-2026-54907

Caddy Proxy Manager is a web interface for managing Caddy Server reverse proxies and certificates. Prior to 1.5.1, Caddy Proxy Manager enables email and password self-registration by default at /api/auth/sign-up/email, allowing an unauthenticated remote actor to create an active account with the user role without administrator approval. The user role cannot view or modify proxy data, so the direct impact is limited to unauthorized creation of low-privilege accounts. The fixed configuration in src/lib/config.ts and src/lib/auth-server.ts requires AUTH_ALLOW_SELF_REGISTRATION=true before the authentication library's disableSignUp control permits sign-up. This issue is fixed in version 1.5.1.

• CWE-1188

• https://github.com/fuomag9/caddy-proxy-manager/commit/ed6d04f0d80a9c4c234e83e11af6fe635ce117cc
• https://github.com/fuomag9/caddy-proxy-manager/releases/tag/v1.5.1
• https://github.com/fuomag9/caddy-proxy-manager/security/advisories/GHSA-4wcc-gwxr-gc9p

Published

Sep 17, 2026

Last Modified

Sep 23, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-54901Oj (Optimized JSON) is a JSON parser and Object marshaller p…6.3
• CVE-2026-54902Oj (Optimized JSON) is a JSON parser and Object marshaller p…6.3
• CVE-2026-54903Oj (Optimized JSON) is a JSON parser and Object marshaller p…6.3
• CVE-2026-54904concurrent-ruby is a modern concurrency tools for Ruby. Prio…7.5
• CVE-2026-54905concurrent-ruby is a modern concurrency tools for Ruby. Prio…5.5
• CVE-2026-54906concurrent-ruby is a modern concurrency tools for Ruby. Prio…9.8
• CVE-2026-54908Pion DTLS is a Go implementation of Datagram Transport Layer…6.3
• CVE-2026-54909pion/stun is a Go implementation of STUN. Prior to 3.1.3, XO…5.3
• CVE-2026-5491DriveLock Directory Traversal Information Disclosure Vulnera…7.5
• CVE-2026-54910FileBrowser Quantum is a free, self-hosted, web-based file m…7.7
• CVE-2026-54911UltraJSON is a fast JSON encoder and decoder written in pure…6.5
• CVE-2026-54915Tautulli is a Python based monitoring and tracking tool for …5.4