CVE-2026-54907: Caddy Proxy Manager: Registrations enabled by default allows creating users with "user" permission
Caddy Proxy Manager is a web interface for managing Caddy Server reverse proxies and certificates. Prior to 1.5.1, Caddy Proxy Manager enables email and password self-registration by default at /api/auth/sign-up/email, allowing an unauthenticated remote actor to create an active account with the user role without administrator approval. The user role cannot view or modify proxy data, so the direct impact is limited to unauthorized creation of low-privilege accounts. The fixed configuration in src/lib/config.ts and src/lib/auth-server.ts requires AUTHALLOWSELFREGISTRATION=true before the authentication library's disableSignUp control permits sign-up. This issue is fixed in version 1.5.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Caddy Proxy Managerto a version that resolves this vulnerability.Fixed in 1.5.1 - Configuration
Set AUTH_ALLOW_SELF_REGISTRATION=false so email/password self-registration is not enabled; in src/lib/config.ts and src/lib/auth-server.ts the auth library's disableSignUp control permits sign-up only when AUTH_ALLOW_SELF_REGISTRATION=true.
Caddy Proxy Manager (AUTH_ALLOW_SELF_REGISTRATION) AUTH_ALLOW_SELF_REGISTRATION = false
Event History
Frequently Asked Questions
Which deployments are exposed by default?
Caddy Proxy Manager versions prior to 1.5.1 enable email-and-password self-registration by default. An unauthenticated remote user can register through the /api/auth/sign-up/email endpoint unless the deployment has otherwise prevented access to it.
What access does an attacker gain after registering?
The attacker receives an active account with the user role and does not require administrator approval. That role cannot view or modify proxy data, so the documented direct impact is unauthorized creation of low-privilege accounts.
What configuration is required after upgrading?
In the fixed behavior, self-registration is permitted only when AUTH_ALLOW_SELF_REGISTRATION=true is set. Without that setting, the authentication library's disableSignUp control prevents sign-up.
What should be done if an immediate upgrade is not possible?
Prevent unauthenticated access to the /api/auth/sign-up/email registration endpoint. This limits remote actors from creating new user-role accounts until version 1.5.1 can be deployed.