GHSA-m2hx-wjxc-9fp4MediumCVSS 5.0

Gokapi has privilege escalation with auth token

Published
March 5, 2026
Last Modified
March 6, 2026

🔗 CVE IDs covered (1)

CVE-2026-29060 →

📋 Description

Impact

A registered user without privileges to create or modify file requests is able to create a short-lived API key that has the permission to do so.

The user must be registered with Gokapi. If you do not have any other users with access to the admin/upload menu, you are not impacted.

Patches

This CVE is patched in v2.2.3

🎯 Affected products1

  • go/github.com/forceu/gokapi:< 2.2.3

🔗 References (4)