CVE-2026-29060

Description

Gokapi is a self-hosted file sharing server with automatic expiration and encryption support. Prior to version 2.2.3, a registered user without privileges to create or modify file requests is able to create a short-lived API key that has the permission to do so. The user must be registered with Gokapi. If there are no users with access to the admin/upload menu, there is no impact. This issue has been patched in version 2.2.3.

PUBLISHED Reserved 2026-03-03 | Published 2026-03-06 | Updated 2026-03-06 | Assigner GitHub_M

Problem types

CWE-284: Improper Access Control

Product status

References

github.com/...Gokapi/security/advisories/GHSA-m2hx-wjxc-9fp4

github.com/Forceu/Gokapi/releases/tag/v2.2.3

cve.org (CVE-2026-29060)

nvd.nist.gov (CVE-2026-29060)

Download JSON