CVEvulnerability

CVE-2026-11345

6.9 MEDIUM Published 2026-06-05 Modified 2026-06-17 Official page ↗
Status
Deferred
Published
2026-06-05
Last modified
2026-06-17
Assigner
86c47df7-7d28-48da-920a-6423c52fd3da
CVSS 4.0 (86c47df7-7d28-48da-920a-6423c52fd3da)
6.9 MEDIUM — CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weaknesses
CWE-287

Description

An Improper Authentication vulnerability in the /api/Cdn/GetFile endpoint of linqi allows unauthenticated, remote attackers to bypass file access controls. The ValidateAnonFileAccess function incorrectly grants access if an 'AnonFile' query parameter containing exactly 256 characters is provided. While this flaw allows bypassing the intended authorization check, the actual security impact is negligible; the exposed resources are strictly limited to minified JavaScript and CSS files that contain no sensitive data and are already publicly accessible via a standard CDN.

Related

Weakness · CWE (1)

  • CWE-287 Improper Authentication weakness

References