---
id: "CVE-2024-58405"
page: "https://infrastack.ai/live/CVE-2024-58405"
kind: "vulnerability"
aliases: ["CVE-2024-58405"]
title: "Zipline: registration endpoint skips invite code check, letting anyone create accounts"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "zipline", "fixed": [], "affected": "<= 3.7.9", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["package", "self-hosted", "zipline"]
not_affected_if: ["invites-disabled", "registration-disabled"]
published_at: "2026-11-13T10:17:23+00:00"
first_seen_at: "2026-11-13T10:47:09+00:00"
updated_at: "2026-11-13T10:54:14+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-58405", "first_seen_at": "2026-11-13T10:47:09+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-13T10:54:14+00:00"}]
exploit_sources: []
---

# Zipline: registration endpoint skips invite code check, letting anyone create accounts

Link for people: https://infrastack.ai/live/CVE-2024-58405 (this .md is for agents)

Zipline through 3.7.9 enforces invite codes on /api/auth/register only when user registration is disabled, so with invites and registration both enabled, a POST request without an invite code still creates an account. An unauthenticated attacker can use this to create accounts, view stats, and fill storage by uploading many files.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:zipline affected <= 3.7.9 fixed no fixed version listed

## How to check

Self-hosted Zipline <= 3.7.9: check env/config for FEATURES_USER_REGISTRATION=true together with FEATURES_INVITES=true. Test: POST /api/auth/register with {"username":..,"password":..} and no invite code; a 200 means exposed, 'Bad invite' means not.

## Fix

No patched version listed in the maintainer advisory (GHSA-j2cw-9fvc-wr4r). Workaround: set FEATURES_USER_REGISTRATION=false (remove it) and keep FEATURES_INVITES=true; the register endpoint then enforces invites.

## Timeline

- 2026-11-13T10:47:09+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2024-58405
- 2026-11-13T10:54:14+00:00 analyst — Read maintainer GHSA: affected <= 3.7.9, patched versions listed as None; advisory says a fix exists in a PR (not linked/read). Config-dependent: FEATURES_USER_REGISTRATION=true plus FEATURES_INVITES=true. PoC is inline in the advisory.

## Documents

- [advisory] Vendor advisory: github.com https://github.com/diced/zipline/security/advisories/GHSA-j2cw-9fvc-wr4r
- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/zipline-through-3.7.9-invite-bypass-via-api-auth-register-endpoint

## From the sources

Zipline through 3.7.9 contains an improper authorization vulnerability in the /api/auth/register endpoint, which enforces invite codes only when user registration is disabled, so registration succeeds without an invite when both invites and user registration are enabled. Unauthenticated attackers can send a direct POST request omitting the invite code to create accounts, view stats, and exhaust storage by uploading many files.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_