forceu/gokapi · Security
Gokapi has privilege escalation with auth token
- GHSA ID
- GHSA-m2hx-wjxc-9fp4
- CVE ID
- CVE-2026-29060
- Severity
- medium
- Published
- Updated
- CVSS
- 5 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:L
- CVSS v3
- 5 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:L
Description
Impact
A registered user without privileges to create or modify file requests is able to create a short-lived API key that has the permission to do so.
The user must be registered with Gokapi. If you do not have any other users with access to the admin/upload menu, you are not impacted.
Patches
This CVE is patched in v2.2.3
CWEs
- CWE-284 · Improper Access Control