PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-111653 53AI CVE debrief

The CVE-2026-111653 vulnerability in 53AIHub through version 0.5.3 allows unauthenticated attackers to overwrite enterprise profiles by sending PUT requests to /api/enterprises/:id. This could lead to defacement or phishing attacks. Defenders should prioritize verifying affected versions and applying patches or mitigations to prevent unauthorized modifications to enterprise profiles. The vulnerability has a CVSS score of 6.9 and is considered MEDIUM severity. The CVE record was published on 2026-10-16T17:39:20.030Z.

Vendor
53AI
Product
53AIHub
CVSS
MEDIUM 6.9
CISA KEV
Not listed in stored evidence
Original CVE published
2026-10-16
Original CVE updated
2026-10-23
Advisory published
2026-10-16
Advisory updated
2026-10-23

Who should care

Defenders responsible for 53AIHub deployments should assess exposure and prioritize patching or mitigating the vulnerability to prevent unauthorized modifications to enterprise profiles.

Why it matters

The CVE-2026-111653 vulnerability in 53AIHub allows unauthenticated attackers to overwrite enterprise profiles, potentially leading to defacement or phishing attacks. Defenders should prioritize verifying affected versions and applying patches or mitigations.

  • Potential unauthorized modifications to enterprise profiles, including logos, display names, and branding.
  • Possible defacement or phishing attacks through overwritten enterprise profiles.
  • Required verification of affected versions and application of patches or mitigations.
  • Potential enumeration of sequential enterprise IDs to overwrite profiles.

Technical summary

The 53AIHub application through version 0.5.3 contains a missing authentication vulnerability that allows unauthenticated attackers to overwrite any enterprise's profile by sending PUT requests to /api/enterprises/:id. This vulnerability is due to the UpdateEnterprise function only enforcing checks when IS_SAAS is true, allowing attackers to enumerate sequential enterprise IDs and overwrite logos, display names, and branding for defacement and phishing attacks. Defenders should prioritize verifying the affected version 0.5.3 of 53AIHub and applying patches or mitigations to prevent unauthorized enterprise profile modifications.

Defensive priority

Defenders should prioritize verifying the affected version 0.5.3 of 53AIHub and applying patches or mitigations to prevent unauthorized enterprise profile modifications.

Recommended defensive actions

  • Verify the version of 53AIHub in use and check if it is affected by version 0.5.3.
  • Apply patches or mitigations provided by the vendor to fix the missing authentication vulnerability.
  • Monitor API requests to /api/enterprises/:id for suspicious activity.
  • Restrict access to the API endpoint to authenticated users only.
  • Review compensating controls for exposed systems while remediation is scheduled and verified.
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented.
  • Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and source item provide details on the missing authentication vulnerability in 53AIHub through version 0.5.3, which allows unauthenticated attackers to overwrite enterprise profiles. The vulnerability is confirmed to exist in version 0.5.3, and defenders should verify the affected version and apply patches or mitigations. The source item provides additional information on the vulnerability, and the CVE Program record offers official CVE metadata.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-111653 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-111653

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-111653 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-111653

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • 53AIHub through 0.5.3 Missing Authentication via PUT /api/enterprises/:id

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/111xxx/CVE-2026-111653.json

    cve_program_cvelist_v5

  • Source reference

    Unverified legacy reference

    URL: https://hackmd.io/@hieuPenguinnn/53aihub-unauth-cross-tenant-enterprise-update

    Supplemental source - third-party-advisory

  • Source reference

    Unverified legacy reference

    URL: https://github.com/53AI/53AIHub/blob/v0.5.3/api/router/api.go

    Supplemental source - technical-description

  • Source reference

    Unverified legacy reference

    URL: https://github.com/53AI/53AIHub/blob/v0.5.3/api/controller/enterprise.go

    Supplemental source - technical-description

  • Source reference

    Unverified legacy reference

    URL: https://www.vulncheck.com/advisories/53aihub-through-0.5.3-missing-authentication-via-put-api-enterprises-id

    Supplemental source - third-party-advisory

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.