CVE-2026-111653: Missing Authentication for Critical Function in 53AI 53AIHub

CVE-2026-111653 describes a missing authentication vulnerability in 53AIHub through version 0.5.3. The vulnerability arises because the UpdateEnterprise API endpoint does not enforce authentication unless the IS_SAAS flag is set to true. This allows unauthenticated attackers to send PUT requests to /api/enterprises/:id and overwrite any enterprise's profile data, including logos and branding. Attackers can enumerate enterprise IDs sequentially to target multiple enterprises. The CVSS 4.0 base score is 6.9, reflecting a medium severity with network attack vector, no privileges required, and no user interaction needed.

An unauthenticated attacker can overwrite critical enterprise profile information such as logos, display names, and branding. This can lead to defacement of enterprise profiles and facilitate phishing attacks by impersonating legitimate enterprises. The vulnerability affects all deployments of 53AIHub up to and including version 0.5.3 where the IS_SAAS flag is not enforced for authentication checks.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the /api/enterprises/:id endpoint to authenticated users only, and verify that authentication checks are enforced regardless of the IS_SAAS flag. Monitor for unauthorized changes to enterprise profiles and consider implementing additional access controls or API gateway protections.