GitHub Advisoryadvisory · Go

GHSA-q658-hfpg-35qc Gokapi has privilege escalation via incomplete API-key permission revocation on user rank demotion

MEDIUM Published 2026-03-05 Modified 2026-03-06 Official page ↗
Aliases
CVE-2026-29061
Ecosystem
Go
Packages
github.com/forceu/gokapi
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-284
Reviewed
2026-03-05

Affected packages

• Go github.com/forceu/gokapi: < 2.2.3 → fixed in 2.2.3

Description

Summary A privilege escalation vulnerability in the user rank demotion logic allows a demoted user's existing API keys to retain ApiPermManageFileRequests and ApiPermManageLogs permissions, enabling continued access to upload-request management and log viewing endpoints after the user has been stripped of all privileges. Impact Any user who previously held Admin rank and had API keys with ApiPermManageFileRequests or ApiPermManageLogs retains those capabilities after demotion. This allows offboarded or demoted users to: • Create, list, and delete upload requests • Read application logs and system status

Related

Alias · CVE (1)

  • CVE-2026-29061 Gokapi is a self-hosted file sharing server with automatic expiration and encryption support. vulnerability

Weakness · CWE (1)

  • CWE-284 Improper Access Control weakness

References