EUVD-2026-103075
GHSA-8wfx-4q5w-fv72
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach exposed /api/enterprises endpoint
-
DeliveryEnumerate sequential enterprise IDs
-
ExploitSend unauthenticated PUT update request
-
ExecutionOverwrite logo and branding fields
-
ImpactServe defacement or phishing content
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication required for critical functions
MITRE ATT&CK
1 technique across 1 tactic: Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitable only when the instance runs with IS_SAAS not set to true: UpdateEnterprise enforces authorization checks exclusively in SaaS mode, so self-hosted/single-tenant deployments leave PUT /api/enterprises/:id completely unauthenticated. The required prerequisites are minimal - network reachability to the API and knowledge (or enumeration) of sequential integer enterprise IDs, which are trivially guessable. Limiting factors: impact is confined to writable profile/branding fields (logo, display name, branding) with no data disclosure or service disruption, and deployments correctly configured in SaaS mode (IS_SAAS=true) are NOT vulnerable because the authorization checks engage. |
| Impact | This is a genuine but moderate-severity integrity issue, not a top-tier emergency. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms remote, unauthenticated, low-complexity exploitation with no user interaction, which aligns perfectly with the CWE-306 (Missing Authentication) root cause and the description's claim of unauthenticated PUT requests. Crucially, the impact is bounded: the 4.0 vector sets VC:N/VI:L/VA:N (and the 3.1 equivalent C:N/I:L/A:N), meaning only integrity is affected and only at a LOW level - attackers can tamper with enterprise branding (logos, display names) but cannot read data, escalate, or disrupt availability. No EPSS score was provided, so exploitation probability cannot be quantified. KEV status is NO and there is no confirmed public exploit code, so despite trivial exploitability the real-world risk is currently theoretical/opportunistic rather than actively weaponized. A key nuance the raw 6.9 score hides: exploitation depends on the deployment running with IS_SAAS=false, so the flaw is conditional on configuration, not universal. The signals are internally consistent (no conflicts between CVSS, CWE, and description); the main gap is the absence of EPSS and KEV data to gauge likelihood. |
| Exploit ScenarioDerived | An attacker scripts PUT requests to /api/enterprises/:id against a self-hosted 53AIHub instance (IS_SAAS not enabled), iterating sequential numeric IDs since no authentication is enforced. For each tenant found, they overwrite the logo and display name with attacker-controlled branding to deface the portal or stage a convincing phishing lure. A detailed technical write-up exists (hackmd), but no weaponized public exploit code was identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 16, 2026
Unauthenticated attackers can overwrite enterprise profile data in 53AIHub through version 0.5.3 by sending crafted PUT requests to /api/enterprises/:id when the deployment does not have IS_SAAS set to true. This allows modification of logos, display names, and branding, enabling defacement or phishing. The independent assessment rates this as a moderate-severity integrity-only issue with no data disclosure or service disruption; no public exploit identified at time of analysis. Deployments correctly configured with IS_SAAS=true are not vulnerable because authorization checks engage in that mode.
RemediationAI
No vendor-released patch identified at time of analysis. The most effective mitigation is to set the IS_SAAS configuration flag to true, which enables the authorization checks in UpdateEnterprise and closes the unauthenticated access; however, this may not be compatible with deployment models that rely on non-SaaS behavior. If that is not feasible, restrict network access to the affected API endpoint (PUT /api/enterprises/:id) using firewall rules or a reverse proxy to allow only trusted administrative IPs, though this may block legitimate remote administration. Another compensating control is to place an authentication layer (e.g., HTTP basic authentication or an API gateway) in front of the endpoint, but this adds operational overhead and could interfere with other API traffic. For environments where the enterprise profile update functionality is not needed, consider disabling or blocking the route at the web server or WAF level, with the trade-off of potential maintenance and bypass risks. Monitor the vendor advisory at https://www.vulncheck.com/advisories/53aihub-through-0.5.3-missing-authentication-via-put-api-enterprises-id for a patched release and apply it as soon as available.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is a missing authentication flaw (CWE-306) in the 53AIHub API. The affected endpoint PUT /api/enterprises/:id is handled by the UpdateEnterprise controller, which contains authorization logic gated behind the IS_SAAS configuration flag. When IS_SAAS is not true (common in self-hosted or single-tenant deployments), the controller skips authentication and authorization checks entirely, allowing any network-reachable client to modify an enterprise's profile fields. The CPE cpe:2.3:a:53ai:53aihub:*:*:*:*:*:*:*:* confirms that all versions up to and including 0.5.3 are affected. Because enterprise IDs are sequential integers, attackers can easily enumerate valid targets. The root cause is the conditional enforcement of checks that should apply unconditionally, leaving a critical function accessible without credentials. Source code references (GitHub router and controller files for v0.5.3) and a public technical write-up are available.
Know when 53Aihub gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Unauthenticated network PUT with no user interaction (PR:N/UI:N/AV:N/AC:L); only low integrity impact from branding overwrite, no confidentiality or availability loss.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
53AIHub through 0.5.3 contains a missing authentication vulnerability that allows unauthenticated attackers to overwrite any enterprise's profile by sending PUT requests to /api/enterprises/:id. Because UpdateEnterprise only enforces checks when IS_SAAS is true, attackers can enumerate sequential enterprise IDs and overwrite logos, display names and branding for defacement and phishing.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB