Vulnerability · Published Sep 17, 2026 · Assigned by GitHub_M

CVE-2026-54907Caddy Proxy Manager: Registrations enabled by default allows creating users with "user" permission

Medium 5.3

In plain English

A medium-severity security flaw in caddy-proxy-manager from fuomag9. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 22% of all known vulnerabilities).

Severity (CVSS 3.1)5.3Medium

Exploit odds (30 days)0.3%top 78.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Caddy Proxy Manager is a web interface for managing Caddy Server reverse proxies and certificates. Prior to 1.5.1, Caddy Proxy Manager enables email and password self-registration by default at /api/auth/sign-up/email, allowing an unauthenticated remote actor to create an active account with the user role without administrator approval. The user role cannot view or modify proxy data, so the direct impact is limited to unauthorized creation of low-privilege accounts. The fixed configuration in src/lib/config.ts and src/lib/auth-server.ts requires AUTH_ALLOW_SELF_REGISTRATION=true before the authentication library's disableSignUp control permits sign-up. This issue is fixed in version 1.5.1.

Affected products (as reported)

Vendor	Product	Versions
fuomag9	caddy-proxy-manager	< 1.5.1

Weakness: CWE-1188 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

References

https://github.com/fuomag9/caddy-proxy-manager/security/advisories/GHSA-4wcc-gwxr-gc9p x_refsource_CONFIRM
https://github.com/fuomag9/caddy-proxy-manager/commit/ed6d04f0d80a9c4c234e83e11af6fe635ce117cc x_refsource_MISC
https://github.com/fuomag9/caddy-proxy-manager/releases/tag/v1.5.1 x_refsource_MISC