CVE-2026-111653: 53AIHub through 0.5.3 Missing Authentication via PUT /api/enterprises/:id

Q: Which deployments are exposed to unauthenticated enterprise-profile changes?

The vulnerable authorization checks are enforced only when IS_SAAS is true. Deployments where those checks are not enforced can allow unauthenticated requests to update enterprise profiles.

Q: What does an attacker need to exploit this issue?

An attacker needs network access to the API endpoint and a target enterprise ID. No credentials or user interaction are required, and sequential enterprise IDs can be enumerated.

Q: What can an attacker change through the vulnerable endpoint?

An attacker can overwrite an enterprise's profile, including its logo, display name, and branding. This can support defacement or phishing.

Q: How can I check whether an instance may be affected?

Review whether the instance runs 53AIHub 0.5.3 or earlier and whether UpdateEnterprise authorization is conditional on IS_SAAS. Also inspect for unexpected changes to enterprise logos, display names, or branding.

Published Oct 16, 2026

Updated

53AIHub through 0.5.3 contains a missing authentication vulnerability that allows unauthenticated attackers to overwrite any enterprise's profile by sending PUT requests to /api/enterprises/:id. Because UpdateEnterprise only enforces checks when ISSAAS is true, attackers can enumerate sequential enterprise IDs and overwrite logos, display names and branding for defacement and phishing.

Affected Software

1 affected component

53AIHub 53AIHub<=0.5.3

Event History

Oct 16, 2026

CVE Published

via MITRE·05:39 PM

Data Sourced

via MITRE·05:39 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed to unauthenticated enterprise-profile changes?

The vulnerable authorization checks are enforced only when IS_SAAS is true. Deployments where those checks are not enforced can allow unauthenticated requests to update enterprise profiles.

What does an attacker need to exploit this issue?

An attacker needs network access to the API endpoint and a target enterprise ID. No credentials or user interaction are required, and sequential enterprise IDs can be enumerated.

What can an attacker change through the vulnerable endpoint?

An attacker can overwrite an enterprise's profile, including its logo, display name, and branding. This can support defacement or phishing.

How can I check whether an instance may be affected?

Review whether the instance runs 53AIHub 0.5.3 or earlier and whether UpdateEnterprise authorization is conditional on IS_SAAS. Also inspect for unexpected changes to enterprise logos, display names, or branding.

CVE-2026-111653: 53AIHub through 0.5.3 Missing Authentication via PUT /api/enterprises/:id

Affected Software

Event History

Frequently Asked Questions

Which deployments are exposed to unauthenticated enterprise-profile changes?

What does an attacker need to exploit this issue?

What can an attacker change through the vulnerable endpoint?

How can I check whether an instance may be affected?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to unauthenticated enterprise-profile changes?

What does an attacker need to exploit this issue?

What can an attacker change through the vulnerable endpoint?

How can I check whether an instance may be affected?