Advisory · CVE-2024-58405
Zipline invite endpoint lets low-privilege users open registration
Zipline before 3.7.11 and 4.0.0 before 4.3.1 has an incorrect authorization flaw in the invite create endpoint that lets low-privilege authenticated users generate invitation codes despite allow_registrations=false. Attackers can bypass the registration restriction and create arbitrary user accounts on the server; fixed in 3.7.11 and 4.3.1.
- Vendor
- Zipline
- Product
- Zipline
- Identifier / CWE
- CVE-2024-58405
CWE-863 - Action timing
- Immediate
Explain it like I’m five
Zipline can be set to closed sign-ups, with new users only by invitation. A low-privilege user can use the invite endpoint to make invitation codes anyway, letting anyone create accounts on a server that was supposed to be closed.
- 01Invite requested
A low-privilege authenticated user calls the invite create endpoint.
- 02Setting ignored
The endpoint generates an invitation code even though allow_registrations=false.
- 03Accounts created
The attacker uses the code to create arbitrary user accounts on the server.
What happened
Zipline before 3.7.11 and 4.0.0 before 4.3.1 contains an incorrect authorization vulnerability in the invite create endpoint that allows low-privilege authenticated users to generate invitation codes despite the configured allow_registrations=false setting. Attackers can exploit the invite creation endpoint to bypass the registration restriction and create arbitrary user accounts on the server. The record rates it high at CVSS 8.6.
What to do
- Upgrade to 3.7.11 or 4.3.1, matching the installed branch.
- Audit user accounts created recently and remove any that should not exist.
- Review invitation codes issued and revoke unfamiliar ones.
- Confirm the patched version is running.
Management note
A closed server that is not actually closed. The patch is small, but the account audit matters: unknown accounts created through this gap stay valid after the upgrade.