https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-06T20:47:27.360781+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-276014 EUVD-2026-276014 2026-10-06T20:47:27.405186+00:00 EUVD-2026-276014 https://cve.radiocsirt.org/vuln/fkie_cve-2026-30943 fkie_cve-2026-30943 2026-10-06T20:47:27.405224+00:00

Gokapi is a self-hosted file sharing server with automatic expiration and encryption support. Prior to 2.2.4, An insufficient authorization check in the file replace API allows a user with only list visibility permission (UserPermListOtherUploads) to delete another user's file by abusing the deleteNewFile flag, bypassing the requirement for UserPermDeleteOtherUploads. This vulnerability is fixed in 2.2.4.

 https://cve.radiocsirt.org/vuln/ghsa-j6jp-78w8-34x6 GHSA-j6jp-78w8-34x6 — Gokapi vulnerable to Privilege Escalation in File Replace 2026-10-06T20:47:27.405257+00:00

Affected: Go: github.com/forceu/gokapi

## Summary

An insufficient authorization check in the file replace API allows a user with only list visibility permission (`UserPermListOtherUploads`) to delete another user's file by abusing the `deleteNewFile` flag, bypassing the requirement for `UserPermDeleteOtherUploads`.

### Impact

Any authenticated user with `PERM_REPLACE` (replace own files) and `PERM_LIST` (view other users' uploads) can delete any other user's file without needing `PERM_DELETE`.