CVE-2026-111653 Details

A missing authentication vulnerability has been identified in 53AIHub versions through 0.5.3. This vulnerability allows unauthenticated attackers to overwrite the profiles of any enterprise by sending PUT requests to /api/enterprises/:id. The issue arises because the UpdateEnterprise function only enforces authentication checks when the IS_SAAS configuration is true. As a result, attackers can enumerate enterprise IDs and modify branding elements such as logos and display names, potentially leading to defacement and phishing attacks.

To address this vulnerability, the PUT /api/enterprises/:id route should be protected with authentication middleware to require a user token and verify that the user has admin privileges. Additionally, the enterprise ownership check should be enforced unconditionally, regardless of the IS_SAAS configuration.