forceu/gokapi · Security
Gokapi vulnerable to Privilege Escalation in File Replace
- GHSA ID
- GHSA-j6jp-78w8-34x6
- CVE ID
- CVE-2026-30943
- Severity
- medium
- Published
- Updated
- CVSS
- 4.1 · CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:L/A:N
- CVSS v3
- 4.1 · CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:L/A:N
Description
Summary
An insufficient authorization check in the file replace API allows a user with only list visibility permission (UserPermListOtherUploads) to delete another user's file by abusing the deleteNewFile flag, bypassing the requirement for UserPermDeleteOtherUploads.
Impact
Any authenticated user with PERM_REPLACE (replace own files) and PERM_LIST (view other users' uploads) can delete any other user's file without needing PERM_DELETE.
CWEs
- CWE-863 · Incorrect Authorization