CVE-2026-111653

EUVD-2026-103075
53AIHub through 0.5.3 contains a missing authentication vulnerability that allows unauthenticated attackers to overwrite any enterprise's profile by sending PUT requests to /api/enterprises/:id. Because UpdateEnterprise only enforces checks when IS_SAAS is true, attackers can enumerate sequential enterprise IDs and overwrite logos, display names and branding for defacement and phishing.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
5.3 MEDIUM
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: 27.73%
Common Weakness Enumeration
References
https://github.com/53AI/53AIHub/blob/v0.5.3/api/controller/enterprise.go#L122-L160
https://github.com/53AI/53AIHub/blob/v0.5.3/api/router/api.go#L54-L66
https://hackmd.io/@hieuPenguinnn/53aihub-unauth-cross-tenant-enterprise-update
https://www.vulncheck.com/advisories/53aihub-through-0.5.3-missing-authentication-via-put-api-enterprises-id