https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-07T23:20:40.702836+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-274773 EUVD-2026-274773 2026-10-07T23:20:40.751139+00:00 EUVD-2026-274773 https://cve.radiocsirt.org/vuln/fkie_cve-2026-29060 fkie_cve-2026-29060 2026-10-07T23:20:40.751175+00:00

Gokapi is a self-hosted file sharing server with automatic expiration and encryption support. Prior to version 2.2.3, a registered user without privileges to create or modify file requests is able to create a short-lived API key that has the permission to do so. The user must be registered with Gokapi. If there are no users with access to the admin/upload menu, there is no impact. This issue has been patched in version 2.2.3.

 https://cve.radiocsirt.org/vuln/ghsa-m2hx-wjxc-9fp4 GHSA-m2hx-wjxc-9fp4 — Gokapi has privilege escalation with auth token 2026-10-07T23:20:40.751207+00:00

Affected: Go: github.com/forceu/gokapi

### Impact A registered user without privileges to create or modify file requests is able to create a short-lived API key that has the permission to do so.

The user must be registered with Gokapi. If you do not have any other users with access to the admin/upload menu, you are not impacted.

### Patches This CVE is patched in v2.2.3