https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-07T12:56:26.400950+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2026-29061 CVE-2026-29061 — Gokapi: Privilege escalation via incomplete API-key permission revocation on user rank demotion 2026-10-07T12:56:26.414620+00:00

Affected: Forceu Gokapi

Gokapi is a self-hosted file sharing server with automatic expiration and encryption support. Prior to version 2.2.3, a privilege escalation vulnerability in the user rank demotion logic allows a demoted user's existing API keys to retain ApiPermManageFileRequests and ApiPermManageLogs permissions, enabling continued access to upload-request management and log viewing endpoints after the user has been stripped of all privileges. This issue has been patched in version 2.2.3.