CVE-2024-58405
Received Received - Intake

Improper Authorization in Zipline Leading to Unauthenticated Account Creation

Publication date: 2026-11-13

Last updated on: 2026-11-13

Assigner: VulnCheck

Description
Zipline through 3.7.9 contains an improper authorization vulnerability in the /api/auth/register endpoint, which enforces invite codes only when user registration is disabled, so registration succeeds without an invite when both invites and user registration are enabled. Unauthenticated attackers can send a direct POST request omitting the invite code to create accounts, view stats, and exhaust storage by uploading many files.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-13
Last Modified
2026-11-13
Generated
2026-11-13
AI Q&A
2026-11-13
EPSS Evaluated
N/A
NVD
CVE-2024-58405
EUVD
EUVD-2024-55849

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
diced zipline From 0 (inc) to 3.7.9 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2024-58405 is an improper authorization vulnerability in Zipline version 3.7.9 affecting the /api/auth/register endpoint. When user registration is enabled alongside invite codes, the system fails to enforce invite code requirements during registration. Unauthenticated attackers can exploit this by sending a POST request without an invite code to create accounts, view statistics, and upload files, consuming storage resources.

Detection Guidance

To detect this vulnerability, monitor for unauthorized account creation attempts via the /api/auth/register endpoint. Check server logs for POST requests to this endpoint without an invite code parameter. Use network monitoring tools to inspect traffic for suspicious registration activity.

Impact Analysis

This vulnerability allows unauthorized users to create accounts and access server statistics without permission. Attackers can upload excessive files to exhaust storage, potentially causing service disruptions. The lack of invite code enforcement removes a critical access control measure, increasing the risk of abuse and unauthorized data access.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection principles and HIPAA's access controls. Unauthorized account creation and data exposure risks non-compliance with privacy and security requirements, potentially resulting in legal penalties and reputational damage.

Mitigation Strategies

Immediately disable user registration by setting FEATURES_USER_REGISTRATION=false in your Zipline configuration. Ensure invite-only mode is enforced by verifying FEATURES_INVITES=true and invite codes are required. Update to the latest version if available.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2024-58405. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...