https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-06T10:27:23.792031+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-274772 EUVD-2026-274772 2026-10-06T10:27:23.857597+00:00 EUVD-2026-274772 https://cve.radiocsirt.org/vuln/fkie_cve-2026-29061 fkie_cve-2026-29061 2026-10-06T10:27:23.857642+00:00

Gokapi is a self-hosted file sharing server with automatic expiration and encryption support. Prior to version 2.2.3, a privilege escalation vulnerability in the user rank demotion logic allows a demoted user's existing API keys to retain ApiPermManageFileRequests and ApiPermManageLogs permissions, enabling continued access to upload-request management and log viewing endpoints after the user has been stripped of all privileges. This issue has been patched in version 2.2.3.

 https://cve.radiocsirt.org/vuln/ghsa-q658-hfpg-35qc GHSA-q658-hfpg-35qc — Gokapi has privilege escalation via incomplete API-key permission revocation on user rank demotion 2026-10-06T10:27:23.857682+00:00

Affected: Go: github.com/forceu/gokapi

### Summary A privilege escalation vulnerability in the user rank demotion logic allows a demoted user's existing API keys to retain ApiPermManageFileRequests and ApiPermManageLogs permissions, enabling continued access to upload-request management and log viewing endpoints after the user has been stripped of all privileges.

### Impact Any user who previously held Admin rank and had API keys with ApiPermManageFileRequests or ApiPermManageLogs retains those capabilities after demotion. This allows offboarded or demoted users to: - Create, list, and delete upload requests - Read application logs and system status