Which versions of Gladinet CentreStack are affected by CVE-2026-54367?

Gladinet CentreStack versions before 17.2 contain an authentication bypass vulnerability allowing unauthenticated attackers to read, write, and delete account settings, including exposure of all…. A patch is available.

How to fix or mitigate CVE-2026-54367?

Within 24 hours, identify and document all Gladinet CentreStack deployments with version confirmation; restrict network access to CentreStack API endpoints to authorized IP ranges only. Within 7 days, contact Gladinet technical support for interim workarounds, implement Web Application Firewall (WAF) rules to filter unauthorized API access patterns, and enable comprehensive API access logging. Within 30 days, upgrade all CentreStack instances to version 17.2 or later when available, conduct full audit of account modifications and administrator activity logs from the exposure period, and reset all administrator passwords as a precautionary measure.

Gladinet CentreStack CVE-2026-54367

Q: What is the CVSS score of CVE-2026-54367?

CVE-2026-54367 has a CVSS 4.0 base score of 8.8 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-51103 HIGH

Missing Authentication for Critical Function (CWE-306)

2026-07-30 VulnCheck

GHSA-hq66-5q6c-849x

Authentication Bypass Centrestack Gladinet

8.8

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

8.8 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.6 HIGH

Unauthenticated network endpoint with no user interaction gives AV:N/AC:L/PR:N/UI:N; arbitrary write/delete of settings drives I:H while enumeration yields C:L and A:L.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jul 30, 2026 - 14:03 EUVD

Analysis Generated

Jul 30, 2026 - 13:21 vuln.today

CVE Published

Jul 30, 2026 - 12:26 cve.org

HIGH 8.8

DescriptionCVE.org

CentreStack before 17.2 contains an authentication bypass vulnerability that allows unauthenticated attackers to read, write, or delete arbitrary account settings by exploiting exposed API endpoints that lack authorization checks. Attackers can generate valid encrypted EntAcctId values using the static shared encryption key to forge identifiers for any user GUID, including the system-wide cluster settings account, enabling enumeration of hosted tenant domains and administrator identities.

AnalysisAI

Authentication bypass in Gladinet CentreStack before 17.2 lets unauthenticated remote attackers read, write, and delete arbitrary account settings by hitting API endpoints that lack authorization checks (CWE-306). Because a static shared encryption key is used to generate valid encrypted EntAcctId values, an attacker can forge identifiers for any user GUID - including the system-wide cluster settings account - to enumerate hosted tenant domains and administrator identities. There is no public exploit identified at time of analysis, but the flaw was surfaced by VulnCheck and requires no authentication.

Technical ContextAI

CentreStack is Gladinet's enterprise file-sharing and cloud storage platform that presents on-premises file servers as a cloud-style, multi-tenant service. The affected component is its account/settings API, where objects are addressed by an encrypted account identifier (EntAcctId) that maps to a user GUID. The root cause is CWE-306 (Missing Authentication for Critical Function): sensitive settings endpoints do not verify the caller's authorization, and a static, shared encryption key means the EntAcctId token is not a secret bound to a session - any party who knows the key can mint valid identifiers for arbitrary GUIDs, including the special cluster-wide settings account that governs the whole deployment. The affected product per CPE is cpe:2.3:a:gladinet:centrestack:*, i.e. all CentreStack releases prior to 17.2.

RemediationAI

Vendor-released patch: 17.2 - upgrade all CentreStack instances to version 17.2 or later, which is the primary and authoritative fix. If immediate patching is not possible, restrict network exposure of the CentreStack API/portal so the vulnerable settings endpoints are not reachable from untrusted networks (place behind a VPN or IP allowlist), accepting the trade-off that legitimate remote/tenant users may lose direct access; where the platform permits, rotating or replacing the static shared encryption key removes the forgery primitive but may invalidate existing tokens and require re-provisioning, so test before rolling out. Monitor the account/settings API for anomalous EntAcctId access and enumeration patterns in the interim. Refer to the VulnCheck advisory (https://www.vulncheck.com/advisories/centrestack-unauthenticated-api-authorization-bypass) for definitive details.