{"id":"CVE-2024-58405","kind":"vulnerability","aliases":["CVE-2024-58405"],"related":[],"title":"Zipline: registration endpoint skips invite code check, letting anyone create accounts","description":"Zipline through 3.7.9 contains an improper authorization vulnerability in the /api/auth/register endpoint, which enforces invite codes only when user registration is disabled, so registration succeeds without an invite when both invites and user registration are enabled. Unauthenticated attackers can send a direct POST request omitting the invite code to create accounts, view stats, and exhaust storage by uploading many files.","summary":"Zipline through 3.7.9 enforces invite codes on /api/auth/register only when user registration is disabled, so with invites and registration both enabled, a POST request without an invite code still creates an account. An unauthenticated attacker can use this to create accounts, view stats, and fill storage by uploading many files.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"zipline","fixed":[],"affected":"<= 3.7.9","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["package","self-hosted","zipline"],"not_affected_if":["invites-disabled","registration-disabled"],"how_to_check":"Self-hosted Zipline <= 3.7.9: check env/config for FEATURES_USER_REGISTRATION=true together with FEATURES_INVITES=true. Test: POST /api/auth/register with {\"username\":..,\"password\":..} and no invite code; a 200 means exposed, 'Bad invite' means not.","fix":"No patched version listed in the maintainer advisory (GHSA-j2cw-9fvc-wr4r). Workaround: set FEATURES_USER_REGISTRATION=false (remove it) and keep FEATURES_INVITES=true; the register endpoint then enforces invites.","status":"open","published_at":"2026-11-13T10:17:23+00:00","first_seen_at":"2026-11-13T10:47:09+00:00","triaged_at":"2026-11-13T10:49:06+00:00","updated_at":"2026-11-13T10:54:14+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-13T10:49:06Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Zipline: registration endpoint skips invite code check, letting anyone create accounts","impact":"medium","summary":"Zipline through 3.7.9 enforces invite codes on /api/auth/register only when user registration is disabled, so with invites and registration both enabled, a POST request without an invite code still creates an account. An unauthenticated attacker can use this to create accounts, view stats, and fill storage by uploading many files.","audience":"businesses","category":"package","nicknames":[],"who_cares":["zipline","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker creates accounts and fills storage by mass uploading files","analyst_note":"Confirm the fixed version and vendor advisory at the github.com advisory link in the sources; sources do not state a fix.","how_to_check":"- Check the Zipline version in use; affected versions are `3.7.9` and earlier.\n- Review the Zipline settings for invite codes and user registration; the flaw applies when both invites and user registration are enabled.\n- Check whether `/api/auth/register` accepts a POST without an invite code (unknown whether the sources give a specific test).","plain_action":"","product_name":"zipline","needs_analyst":true,"not_affected_if":["registration-disabled","invites-disabled"],"who_is_affected":"Teams that self-host Zipline 3.7.9 or earlier with invite codes and user registration both enabled are exposed, because the registration endpoint skips the invite check in that configuration. Instances with registration disabled, or without invites enabled, are not described as affected by the sources.","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000772,"input_tokens":4625,"output_tokens":619,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm the fixed version and vendor advisory at the github.com advisory link in the sources; sources do not state a fix.","search":"'-2024':13A,16A '-58405':14A,17A '/api/auth/register':31B,84C '3.7.9':26B,76C 'account':11A,55B,64B,124C 'anyon':9A 'attack':58B,111C 'author':80C 'check':7A 'code':6A,29B,51B,89C,121C 'contain':77C 'creat':10A,53B,63B,123C 'cve':12A,15A 'direct':115C 'disabl':37B,95C 'enabl':44B,109C 'endpoint':3A,85C 'enforc':27B,87C 'exhaust':128C 'file':73B,133C 'fill':68B 'host':22B 'improp':79C 'invit':5A,28B,40B,50B,88C,101C,104C,120C 'let':8A 'mani':72B,132C 'omit':118C 'packag':19B 'post':46B,116C 'registr':2A,35B,42B,93C,97C,107C 'request':47B,117C 'self':21B 'self-host':20B 'send':113C 'skip':4A 'stat':66B,126C 'still':52B 'storag':69B,129C 'succeed':98C 'unauthent':57B,110C 'upload':71B,131C 'use':60B 'user':34B,92C,106C 'view':65B,125C 'vulner':81C 'without':48B,99C 'ziplin':1A,23B,24B,74C 'zipline':18A","nicknames":[],"mitigations":[],"who_affected":"Teams that self-host Zipline 3.7.9 or earlier with invite codes and user registration both enabled are exposed, because the registration endpoint skips the invite check in that configuration. Instances with registration disabled, or without invites enabled, are not described as affected by the sources.","tier":"B","verified":{"fix":{"at":"2026-11-13T10:54:14Z","by":"analyst","doc":"https://github.com/diced/zipline/security/advisories/GHSA-j2cw-9fvc-wr4r","run_id":3870},"products":{"at":"2026-11-13T10:54:14Z","by":"analyst","doc":"https://github.com/diced/zipline/security/advisories/GHSA-j2cw-9fvc-wr4r","run_id":3870},"how_to_check":{"at":"2026-11-13T10:54:14Z","by":"analyst","doc":"https://github.com/diced/zipline/security/advisories/GHSA-j2cw-9fvc-wr4r","run_id":3870},"who_affected":{"at":"2026-11-13T10:54:14Z","by":"analyst","doc":"https://github.com/diced/zipline/security/advisories/GHSA-j2cw-9fvc-wr4r","run_id":3870}},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["zipline"],"ptokens":["zipline"],"labels":["high","package","selfhosted","vendor","zipline"],"campaign_type":null,"search_a":"'-2024':13A,16A '-58405':14A,17A 'account':11A 'anyon':9A 'check':7A 'code':6A 'creat':10A 'cve':12A,15A 'endpoint':3A 'invit':5A 'let':8A 'registr':2A 'skip':4A 'ziplin':1A 'zipline':18A","search_b":"'/api/auth/register':31B '3.7.9':26B 'account':55B,64B 'attack':58B 'code':29B,51B 'creat':53B,63B 'disabl':37B 'enabl':44B 'enforc':27B 'file':73B 'fill':68B 'host':22B 'invit':28B,40B,50B 'mani':72B 'packag':19B 'post':46B 'registr':35B,42B 'request':47B 'self':21B 'self-host':20B 'stat':66B 'still':52B 'storag':69B 'unauthent':57B 'upload':71B 'use':60B 'user':34B 'view':65B 'without':48B 'ziplin':23B,24B","search_c":"'/api/auth/register':84C '3.7.9':76C 'account':124C 'attack':111C 'author':80C 'code':89C,121C 'contain':77C 'creat':123C 'direct':115C 'disabl':95C 'enabl':109C 'endpoint':85C 'enforc':87C 'exhaust':128C 'file':133C 'improp':79C 'invit':88C,101C,104C,120C 'mani':132C 'omit':118C 'post':116C 'registr':93C,97C,107C 'request':117C 'send':113C 'stat':126C 'storag':129C 'succeed':98C 'unauthent':110C 'upload':131C 'user':92C,106C 'view':125C 'vulner':81C 'without':99C 'ziplin':74C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2024-03-05T22:23:49+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2024-58405","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-58405","severity":null,"published_at":"2026-11-13T10:17:23+00:00","modified_at":"2026-11-13T10:17:23+00:00","first_seen_at":"2026-11-13T10:47:09+00:00","fetched_at":"2026-11-13T10:47:09+00:00","note":null},{"source":"analyst","external_id":"CVE-2024-58405:3870","url":null,"severity":null,"published_at":"2026-11-13T10:54:14+00:00","modified_at":"2026-11-13T10:54:14+00:00","first_seen_at":"2026-11-13T10:54:14+00:00","fetched_at":"2026-11-13T10:54:14+00:00","note":"Read maintainer GHSA: affected <= 3.7.9, patched versions listed as None; advisory says a fix exists in a PR (not linked/read). Config-dependent: FEATURES_USER_REGISTRATION=true plus FEATURES_INVITES=true. PoC is inline in the advisory."}],"documents":[{"id":144844,"url":"https://github.com/diced/zipline/security/advisories/GHSA-j2cw-9fvc-wr4r","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2024-03-05T22:23:49+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":144845,"url":"https://www.vulncheck.com/advisories/zipline-through-3.7.9-invite-bypass-via-api-auth-register-endpoint","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}