CVE-2024-58405

CVSS 8.8 (high) · published 2026-11-13

Zipline through 3.7.9 contains an improper authorization vulnerability in the /api/auth/register endpoint, which enforces invite codes only when user registration is disabled, so registration succeeds without an invite when both invites and user registration are enabled. Unauthenticated attackers can send a direct POST request omitting the invite code to create accounts, view stats, and exhaust storage by uploading many files.

Weakness: CWE-863

Source: NVD CVE-2024-58405

References

• https://github.com/diced/zipline/security/advisories/GHSA-j2cw-9fvc-wr4r
• https://www.vulncheck.com/advisories/zipline-through-3.7.9-invite-bypass-via-api-auth-register-endpoint

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.