Executive brief
Caddy Proxy Manager is a web-based control panel for managing Caddy Server reverse proxies and SSL certificates across network infrastructure. Prior to version 1.5.1, the application allowed anyone to create new user accounts by default without administrator approval, enabling unauthorized individuals to obtain access to the system even though the created accounts have limited privileges.
Technical details
The vulnerability is an authentication bypass in the self-registration feature. The /api/auth/sign-up/email endpoint was enabled by default, permitting unauthenticated remote users to create active accounts without prior approval. The root cause was the default configuration not properly disabling the sign-up control in the authentication library. The fix requires explicitly setting AUTH_ALLOW_SELF_REGISTRATION=true to enable registration; the feature is now disabled by default. No special preconditions are required—any network-accessible instance is vulnerable. An attacker can create user accounts with the "user" role, which has limited privileges but still represents unauthorized account creation and potential foothold for lateral movement or reconnaissance.
Affected products
- fuomag9 Caddy Proxy Manager before 1.5.1
Timeline
- 2026-09-17: disclosed
- 2026-06-10: patched: Fix committed; version 1.5.1 released 2026-06-09