https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 06:43:48 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-274772 EUVD-2026-274772 https://cve.radiocsirt.org/vuln/euvd-2026-274772 https://cve.radiocsirt.org/vuln/fkie_cve-2026-29061 <p>Gokapi is a self-hosted file sharing server with automatic expiration and encryption support. Prior to version 2.2.3, a privilege escalation vulnerability in the user rank demotion logic allows a demoted user&#39;s existing API keys to retain ApiPermManageFileRequests and ApiPermManageLogs permissions, enabling continued access to upload-request management and log viewing endpoints after the user has been stripped of all privileges. This issue has been patched in version 2.2.3.</p> <p>Gokapi is a self-hosted file sharing server with automatic expiration and encryption support. Prior to version 2.2.3, a privilege escalation vulnerability in the user rank demotion logic allows a demoted user&#39;s existing API keys to retain ApiPermManageFileRequests and ApiPermManageLogs permissions, enabling continued access to upload-request management and log viewing endpoints after the user has been stripped of all privileges. This issue has been patched in version 2.2.3.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-29061 https://cve.radiocsirt.org/vuln/ghsa-q658-hfpg-35qc <p><strong>Affected:</strong> Go: github.com/forceu/gokapi</p> <p>### Summary A privilege escalation vulnerability in the user rank demotion logic allows a demoted user&#39;s existing API keys to retain ApiPermManageFileRequests and ApiPermManageLogs permissions, enabling continued access to upload-request management and log viewing endpoints after the user has been stripped of all privileges.</p> <p>### Impact Any user who previously held Admin rank and had API keys with ApiPermManageFileRequests or ApiPermManageLogs retains those capabilities after demotion. This allows offboarded or demoted users to: - Create, list, and delete upload requests - Read application logs and system status</p> <p><strong>Affected:</strong> Go: github.com/forceu/gokapi</p> <p>### Summary A privilege escalation vulnerability in the user rank demotion logic allows a demoted user&#39;s existing API keys to retain ApiPermManageFileRequests and ApiPermManageLogs permissions, enabling continued access to upload-request management and log viewing endpoints after the user has been stripped of all privileges.</p> <p>### Impact Any user who previously held Admin rank and had API keys with ApiPermManageFileRequests or ApiPermManageLogs retains those capabilities after demotion. This allows offboarded or demoted users to: - Create, list, and delete upload requests - Read application logs and system status</p> https://cve.radiocsirt.org/vuln/ghsa-q658-hfpg-35qc