GHSA-c36c-7pc2-f2phMediumCVSS 6.4

Gokapi has Data Leak in Upload Status Stream

Published
March 5, 2026
Last Modified
March 8, 2026

🔗 CVE IDs covered (1)

CVE-2026-28682 →

📋 Description

Description

The upload status SSE implementation on /uploadStatus publishes global upload state to any authenticated listener and includes file_id values that are not scoped to the requesting user.

Impact

Any authenticated user can observe other users' file identifiers and retrieve unauthorized content, causing cross-tenant data exposure and loss of confidentiality for uploaded documents.

Issue found by aisafe.io

🎯 Affected products1

  • go/github.com/forceu/gokapi:< 2.2.3

🔗 References (4)