CVE-2018-5955: GitStack unauthenticated user creation via improper input validation

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

critical priorityCVSS 9.8 with no authentication or interaction required, public exploit code, and very high EPSS probability make this an urgent exposure for any internet-reachable GitStack instance.

What it is

GitStack through 2.3.10 fails to sufficiently filter user-controlled input, allowing an unauthenticated attacker to add a user account by supplying the username and password fields to the rest/user/ URI. Because the flaw is reachable over the network with no credentials, it exposes the Git server's account management to anyone who can reach the endpoint.

Impact

An attacker gains the ability to create arbitrary user accounts on the GitStack server, which can lead to unauthorized repository access and further compromise of hosted code and configuration.

Attack surface

Reached remotely over the network via the rest/user/ REST endpoint; the CVSS vector shows no privileges required and no user interaction, so the request can be sent directly by an unauthenticated attacker.

Exploitation

Public exploit references exist (Exploit-DB 44356 and a SecuriTeam advisory), and EPSS is 0.81433 (99.62nd percentile), indicating high predicted exploitation activity; the CVE is not listed in CISA KEV.

What to do

• Upgrade GitStack to a version later than 2.3.10 if one is available; the record does not name a fixed version, so confirm with the vendor.
• If no fixed release exists, restrict network access to the GitStack web interface and REST API to trusted management hosts only.
• Place the GitStack service behind authentication-aware reverse proxy rules that block unauthenticated requests to rest/user/.
• Monitor and audit GitStack user accounts for unauthorized additions and remove any unrecognized accounts.
• Isolate the GitStack host from untrusted networks to limit exposure of the REST endpoint.

Detection

• Review GitStack logs for POST requests to rest/user/ and for user-creation events from unexpected source IPs.
• Alert on new or modified accounts in GitStack that were not created through an approved change process.
• Monitor network traffic to the GitStack REST API for unauthenticated requests to user management endpoints.
• Correlate account creation events with subsequent repository access or cloning activity from new accounts.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.