GitHub Advisoryadvisory · Go

GHSA-j6jp-78w8-34x6 Gokapi vulnerable to Privilege Escalation in File Replace

MEDIUM Published 2026-03-13 Modified 2026-03-24 Official page ↗
Aliases
CVE-2026-30943
Ecosystem
Go
Packages
github.com/forceu/gokapi
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:L/A:N
Weaknesses
CWE-863
Reviewed
2026-03-13

Affected packages

• Go github.com/forceu/gokapi: < 2.2.4 → fixed in 2.2.4

Description

Summary An insufficient authorization check in the file replace API allows a user with only list visibility permission (`UserPermListOtherUploads`) to delete another user's file by abusing the `deleteNewFile` flag, bypassing the requirement for `UserPermDeleteOtherUploads`. Impact Any authenticated user with `PERM_REPLACE` (replace own files) and `PERM_LIST` (view other users' uploads) can delete any other user's file without needing `PERM_DELETE`.

Related

Alias · CVE (1)

  • CVE-2026-30943 Gokapi is a self-hosted file sharing server with automatic expiration and encryption support. vulnerability

Weakness · CWE (1)

  • CWE-863 Incorrect Authorization weakness

References