PT-2026-25356 · Gokapi · Gokapi

Sijisu · Published 2026-03-13 · Updated 2026-03-25 · CVE-2026-30943

Positive Technologies (AI Summary)

CVSS v3.1

4.1

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Gokapi versions prior to 2.2.4

Description Gokapi is a self-hosted file sharing server. An authorization flaw in the file replace API allows a user with list visibility permission (UserPermListOtherUploads) to delete another user's file by manipulating the deleteNewFile flag, circumventing the UserPermDeleteOtherUploads requirement. Any authenticated user possessing PERM REPLACE and PERM LIST permissions can delete files belonging to other users without needing PERM DELETE permission.

Recommendations Update Gokapi to version 2.2.4 or later.

Exploit

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2026-30943

GHSA-J6JP-78W8-34X6

GO-2026-4696

SUSE-SU-2026:1042-1

Affected Products

Gokapi

References · 136

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/30xxx/CVE-2026-30943.json · Exploit
• https://github.com/Forceu/Gokapi/security/advisories/GHSA-j6jp-78w8-34x6 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-30943 · Security Note
• https://osv.dev/vulnerability/CVE-2026-30943 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2026-4696 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-j6jp-78w8-34x6 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:1042-1 · Vendor Advisory
• https://github.com/Forceu/Gokapi/releases/tag/v2.2.4 · Note
• https://github.com/Forceu/Gokapi · Note
• https://suse.com/security/cve/CVE-2026-29049 · Note
• https://suse.com/security/cve/CVE-2026-29196 · Note
• https://suse.com/security/cve/CVE-2026-28342 · Note
• https://suse.com/security/cve/CVE-2026-29781 · Note
• https://suse.com/security/cve/CVE-2026-26196 · Note
• https://suse.com/security/cve/CVE-2026-28407 · Note