GHSA-m2hx-wjxc-9fp4

ghsaUSosv

Gokapi has privilege escalation with auth token

view advisory published 2026-03-05Licence: CC-BY-4.0

### Impact A registered user without privileges to create or modify file requests is able to create a short-lived API key that has the permission to do so. The user must be registered with Gokapi. If you do not have any other users with access to the admin/upload menu, you are not impacted. ### Patches This CVE is patched in v2.2.3

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2026-29060US	medium5.0	0.14% (3rd)	—	2026-03-06
Gokapi is a self-hosted file sharing server with automatic expiration and encryption support. Prior to version 2.2.3, a registered user without privileges to create or modify file…

references

External citations — patches, advisories, analysis.

https://github.com/Forceu/GokapiPACKAGE
https://github.com/Forceu/Gokapi/releases/tag/v2.2.3WEB
https://github.com/Forceu/Gokapi/security/advisories/GHSA-m2hx-wjxc-9fp4WEB
https://nvd.nist.gov/vuln/detail/CVE-2026-29060ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan