forceu/gokapi · Security
Gokapi has Data Leak in Upload Status Stream
- GHSA ID
- GHSA-c36c-7pc2-f2ph
- CVE ID
- CVE-2026-28682
- Severity
- medium
- Published
- Updated
- CVSS
- 6.4 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
- CVSS v3
- 6.4 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Description
Description
The upload status SSE implementation on /uploadStatus publishes global upload state to any authenticated listener and includes file_id values that are not scoped to the requesting user.
Impact
Any authenticated user can observe other users' file identifiers and retrieve unauthorized content, causing cross-tenant data exposure and loss of confidentiality for uploaded documents.
Issue found by aisafe.io
CWEs
- CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor
- CWE-284 · Improper Access Control