Vulnerability · Published Mar 6, 2026 · Assigned by GitHub_M
CVE-2026-29060Gokapi: Privilege escalation with auth token
Medium 5.0
In plain English
A medium-severity improper access control in Gokapi from Forceu. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 4% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Gokapi is a self-hosted file sharing server with automatic expiration and encryption support. Prior to version 2.2.3, a registered user without privileges to create or modify file requests is able to create a short-lived API key that has the permission to do so. The user must be registered with Gokapi. If there are no users with access to the admin/upload menu, there is no impact. This issue has been patched in version 2.2.3.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | github.com/forceu/gokapi | 2.2.3 | GHSA-m2hx-wjxc-9fp4 |
| Go | github.com/forceu/gokapi | no fix listed | GO-2026-4615 |
Affected products (as reported)
Weakness: CWE-284 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:L
References
- https://github.com/Forceu/Gokapi/security/advisories/GHSA-m2hx-wjxc-9fp4 x_refsource_CONFIRM
- https://github.com/Forceu/Gokapi/releases/tag/v2.2.3 x_refsource_MISC