Threats affecting pkg:github/fuomag9/caddy-proxy-manager

CVE-2026-54907 affects Caddy Proxy Manager versions prior to 1.5.1. The vulnerability involves insecure default initialization that enables email and password self-registration at the /api/auth/sign-up/email endpoint without authentication. This allows a remote unauthenticated actor to create an active user account with the user role, which has limited privileges and cannot modify proxy data. The issue is fixed in version 1.5.1 by requiring an explicit configuration to allow self-registration.