Vulnerability · Published Jul 30, 2026 · Assigned by VulnCheck

CVE-2026-54367CentreStack < 17.2 Unauthenticated API Authorization Bypass

High 8.6

In plain English

A high-severity missing authentication in CentreStack from Gladinet. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 26% of all known vulnerabilities).

Severity (CVSS 3.1)8.6High

Exploit odds (30 days)0.3%top 74.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

CentreStack before 17.2 contains an authentication bypass vulnerability that allows unauthenticated attackers to read, write, or delete arbitrary account settings by exploiting exposed API endpoints that lack authorization checks. Attackers can generate valid encrypted EntAcctId values using the static shared encryption key to forge identifiers for any user GUID, including the system-wide cluster settings account, enabling enumeration of hosted tenant domains and administrator identities.

Affected products (as reported)

Vendor	Product	Versions
Gladinet	CentreStack	0 – before 17.2

Weakness: CWE-306 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L

References

Product Homepage product
https://www.vulncheck.com/advisories/centrestack-unauthenticated-api-authorization-bypass third-party-advisory