SpamTitan’s Accidental User Factory: A Comedy of Errors in Email Security!
SpamTitan’s email security has a hilariously unintentional feature: it creates users without asking for permission. Thanks to CVE-2024-45438, anyone can sign up a new user with a simple GET request—no authentication required! It’s like an open invitation to crash the party and take over the DJ booth.
Hot Take:
**_Looks like SpamTitan’s security just went on vacation without telling anyone! Unauthenticated user creation? That’s like leaving your front door wide open with a sign that says, “Come on in, we have cookies!”_**
Key Points:
– A vulnerability in SpamTitan allows unauthenticated user creation.
– The flaw is in the `quarantine.php` file, which doesn’t require authentication.
– The `role_type` parameter is never validated, allowing arbitrary role assignment.
– TitanHQ has released a fix in versions 8.00.101 and 8.01.14.
– The issue was discovered in May 2024 but only disclosed publicly in August 2025.