Nixpkgs security tracker
Untriaged
Permalink
CVE-2026-30943
4.1 MEDIUM
- CVSS version: 3.1
- Attack vector (AV): NETWORK
- Attack complexity (AC): LOW
- Privileges required (PR): HIGH
- User interaction (UI): NONE
- Scope (S): CHANGED
- Confidentiality impact (C): NONE
- Integrity impact (I): LOW
- Availability impact (A): NONE
Activity log
- Created suggestion
Gokapi has Privilege Escalation in File Replace
Gokapi is a self-hosted file sharing server with automatic expiration and encryption support. Prior to 2.2.4, An insufficient authorization check in the file replace API allows a user with only list visibility permission (UserPermListOtherUploads) to delete another user's file by abusing the deleteNewFile flag, bypassing the requirement for UserPermDeleteOtherUploads. This vulnerability is fixed in 2.2.4.
References
-
https://github.com/Forceu/Gokapi/security/advisories/GHSA-j6jp-78w8-34x6 x_refsource_CONFIRM
-
https://github.com/Forceu/Gokapi/releases/tag/v2.2.4 x_refsource_MISC
Affected products
Gokapi
- ==< 2.2.4
Package maintainers
-
@delliottxyz Darragh Elliott <me+git@delliott.xyz>