---
id: CVE-2026-54907
title: >-
  Caddy Proxy Manager is a web interface for managing Caddy Server reverse
  proxies and certificates
summary: >-
  Caddy Proxy Manager is a web interface for managing Caddy Server reverse
  proxies and certificates. Prior to 1.5.1, Caddy Proxy Manager enables email
  and password self-registration by default at /api/auth/sign-up/email, allowing
  an unauth…
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N'
cwe:
  - CWE-1188
vendor: fuomag9
product: caddy-proxy-manager
affected:
  - caddy-proxy-manager < 1.5.1
published: '2026-09-17'
updated: '2026-09-23'
sourceUpdated: '2026-09-23T18:12:04.247'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-54907'
references:
  - url: >-
      https://github.com/fuomag9/caddy-proxy-manager/commit/ed6d04f0d80a9c4c234e83e11af6fe635ce117cc
    label: security-advisories@github.com
  - url: 'https://github.com/fuomag9/caddy-proxy-manager/releases/tag/v1.5.1'
    label: security-advisories@github.com
  - url: >-
      https://github.com/fuomag9/caddy-proxy-manager/security/advisories/GHSA-4wcc-gwxr-gc9p
    label: security-advisories@github.com
tags:
  - nvd
  - cve.org
epss: 0.0029
epssPercentile: 0.19126
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-09-18T20:06:04.115027Z'
ingestedAt: '2026-09-17T21:29:16.983Z'
---

## Overview

Caddy Proxy Manager is a web interface for managing Caddy Server reverse proxies and certificates. Prior to 1.5.1, Caddy Proxy Manager enables email and password self-registration by default at /api/auth/sign-up/email, allowing an unauthenticated remote actor to create an active account with the user role without administrator approval. The user role cannot view or modify proxy data, so the direct impact is limited to unauthorized creation of low-privilege accounts. The fixed configuration in src/lib/config.ts and src/lib/auth-server.ts requires AUTH_ALLOW_SELF_REGISTRATION=true before the authentication library's disableSignUp control permits sign-up. This issue is fixed in version 1.5.1.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.