What is GHSA-q7f4-j8r5-hmxq?

GHSA-q7f4-j8r5-hmxq is a security advisory published by GitHub Security Advisories with High severity. CentreStack before 17.3 contains an unauthenticated deserialization vulnerability in GSNamespace...

Which CVE IDs does GHSA-q7f4-j8r5-hmxq cover?

GHSA-q7f4-j8r5-hmxq covers the following CVE IDs: CVE-2026-54365. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-q7f4-j8r5-hmxq?

GHSA-q7f4-j8r5-hmxq has a CVSS v3 base score of 7.5, published by GitHub Security Advisories.

GHSA-q7f4-j8r5-hmxqHighCVSS 7.5

CentreStack before 17.3 contains an unauthenticated deserialization vulnerability in GSNamespace...

Vendor

GitHub Security Advisories

Published

July 30, 2026

Last Modified

July 30, 2026

🔗 CVE IDs covered (1)

CVE-2026-54365 →

📋 Description

CentreStack before 17.3 contains an unauthenticated deserialization vulnerability in GSNamespace.dll that allows unauthenticated attackers to create arbitrary local OS user accounts by supplying a crafted base64-encoded XML string to exposed API endpoints. Attackers can send a malicious StorageConfigure parameter to the jsonimportuserbyupn, jsonimportuserbyupnex, or japiimportuserbyupn endpoints to trigger InternalImportAdUserByUPN(), causing GladinetCloudMonitor.exe to invoke the NetUserAdd Windows API with attacker-controlled credentials and create arbitrary directories on the server filesystem.

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2026-54365
https://www.centrestack.com
https://www.vulncheck.com/advisories/centrestack-unauthenticated-user-creation-via-deserialization-in-gsnamespace-dll
https://github.com/advisories/GHSA-q7f4-j8r5-hmxq