https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-05T07:13:04.502306+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-274775 EUVD-2026-274775 2026-10-05T07:13:04.551340+00:00 EUVD-2026-274775 https://cve.radiocsirt.org/vuln/fkie_cve-2026-28682 fkie_cve-2026-28682 2026-10-05T07:13:04.551387+00:00

Gokapi is a self-hosted file sharing server with automatic expiration and encryption support. Prior to version 2.2.3, the upload status SSE implementation on /uploadStatus publishes global upload state to any authenticated listener and includes file_id values that are not scoped to the requesting user. This issue has been patched in version 2.2.3.

 https://cve.radiocsirt.org/vuln/ghsa-c36c-7pc2-f2ph GHSA-c36c-7pc2-f2ph — Gokapi has Data Leak in Upload Status Stream 2026-10-05T07:13:04.551430+00:00

Affected: Go: github.com/forceu/gokapi

## Description

The upload status SSE implementation on `/uploadStatus` publishes global upload state to any authenticated listener and includes `file_id` values that are not scoped to the requesting user.

## Impact

Any authenticated user can observe other users' file identifiers and retrieve unauthorized content, causing cross-tenant data exposure and loss of confidentiality for uploaded documents.

*Issue found by [aisafe.io](https://aisafe.io)*