Live › vulnerability › CVE-2026-111653
Go to dashboard53AIHub through 0.5.3 lets unauthenticated attackers send PUT requests to /api/enterprises/:id and overwrite any enterprise's profile. Attackers can enumerate sequential enterprise IDs to change logos, display names and branding for defacement or phishing.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
53AIHub deployments up to and including 0.5.3 are exposed to unauthenticated profile overwrites, per the sources. The sources say the missing check applies only when IS_SAAS is true, so self-hosted instances without that flag may not be affected, but the sources do not confirm this. Teams running 53AIHub exposed to the internet should review it first.
No product ranges from the sources yet.
IS_SAAS enabled, since the sources say the authorization checks only apply when it is true./api/enterprises/:id in web server or proxy logs.0.5.3; the sources do not name a fixed version, so check the vendor release notes./api/enterprises/:id at the reverse proxy.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
53AIHub through 0.5.3 contains a missing authentication vulnerability that allows unauthenticated attackers to overwrite any enterprise's profile by sending PUT requests to /api/enterprises/:id. Because UpdateEnterprise only enforces checks when IS_SAAS is true, attackers can enumerate sequential enterprise IDs and overwrite logos, display names and branding for defacement and phishing.
This page as .md · .json · in your agent: get_signal("CVE-2026-111653")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.