PT-2026-25356 · Gokapi · Gokapi

Sijisu · Publicado 2026-03-13 · Atualizado 2026-03-25 · CVE-2026-30943

Positive Technologies (AI Summary)

CVSS v3.1

4.1

Média

Vetor base

AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Gokapi versions prior to 2.2.4

Description Gokapi is a self-hosted file sharing server. An authorization flaw in the file replace API allows a user with list visibility permission (UserPermListOtherUploads) to delete another user's file by manipulating the deleteNewFile flag, circumventing the UserPermDeleteOtherUploads requirement. Any authenticated user possessing PERM REPLACE and PERM LIST permissions can delete files belonging to other users without needing PERM DELETE permission.

Recommendations Update Gokapi to version 2.2.4 or later.

Exploit

Correção

Incorrect Authorization

Enumeração de Fraquezas

CWE-863

Identificadores relacionados

CVE-2026-30943

GHSA-J6JP-78W8-34X6

GO-2026-4696

SUSE-SU-2026:1042-1

Produtos afetados

Gokapi

Referências · 136

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/30xxx/CVE-2026-30943.json · Exploit
• https://github.com/Forceu/Gokapi/security/advisories/GHSA-j6jp-78w8-34x6 · Aviso do Fabricante
• https://github.com/Forceu/Gokapi/releases/tag/v2.2.4 · Nota
• https://github.com/Forceu/Gokapi · Nota
• https://suse.com/security/cve/CVE-2026-29049 · Nota
• https://suse.com/security/cve/CVE-2026-29196 · Nota
• https://suse.com/security/cve/CVE-2026-28342 · Nota
• https://suse.com/security/cve/CVE-2026-29781 · Nota
• https://suse.com/security/cve/CVE-2026-26196 · Nota
• https://suse.com/security/cve/CVE-2026-28407 · Nota
• https://suse.com/security/cve/CVE-2026-31961 · Nota
• https://suse.com/security/cve/CVE-2026-29084 · Nota
• https://suse.com/security/cve/CVE-2026-31892 · Nota
• https://suse.com/security/cve/CVE-2026-30934 · Nota
• https://suse.com/security/cve/CVE-2026-28279 · Nota