CVE-2026-54907 is an insecure default initialization vulnerability (CWE-1188) in fuomag9's Caddy Proxy Manager. Before version 1.5.1, the software enables email and password self-registration at the endpoint /api/auth/sign-up/email by default. This allows unauthenticated remote actors to create active accounts with the user role without needing administrator approval. The user role is restricted and cannot access or modify proxy configurations, limiting the impact. The vulnerability is addressed in version 1.5.1 by requiring the environment variable AUTH_ALLOW_SELF_REGISTRATION=true to enable sign-up, thus disabling self-registration by default.

The vulnerability allows unauthorized creation of user role accounts without administrator approval. Since the user role cannot view or modify proxy data, the impact is limited to unauthorized low-privilege account creation. There is no direct confidentiality, availability, or high-integrity impact on proxy configurations or certificates.

Upgrade to Caddy Proxy Manager version 1.5.1 or later, where self-registration is disabled by default unless explicitly enabled via AUTH_ALLOW_SELF_REGISTRATION=true. This official fix prevents unauthorized account creation without administrator approval.