Caddy Proxy Manager
Monthly
Caddy Proxy Manager releases prior to 1.5.1 ship with email/password self-registration enabled by default at /api/auth/sign-up/email, so unauthenticated remote attackers can create an active account without any administrator approval step (CVSS 5.3, AV:N/AC:L/PR:N/UI:N). The resulting account is assigned only the low-privilege 'user' role, which cannot view or modify proxy configurations or certificates, so the practical impact is limited to unauthorized account creation and a potential foothold rather than administrative compromise. There is no confirmed active exploitation (not listed in CISA KEV) and no public exploit code identified at time of analysis; version 1.5.1 fixes the insecure default by requiring the operator to set AUTH_ALLOW_SELF_REGISTRATION=true before sign-up is permitted.
Caddy Proxy Manager releases prior to 1.5.1 ship with email/password self-registration enabled by default at /api/auth/sign-up/email, so unauthenticated remote attackers can create an active account without any administrator approval step (CVSS 5.3, AV:N/AC:L/PR:N/UI:N). The resulting account is assigned only the low-privilege 'user' role, which cannot view or modify proxy configurations or certificates, so the practical impact is limited to unauthorized account creation and a potential foothold rather than administrative compromise. There is no confirmed active exploitation (not listed in CISA KEV) and no public exploit code identified at time of analysis; version 1.5.1 fixes the insecure default by requiring the operator to set AUTH_ALLOW_SELF_REGISTRATION=true before sign-up is permitted.