CVE-2026-30943CWE-863

Gokapi has Privilege Escalation in File Replace

Medium · published March 13, 2026

CVSS v3.1
4.1
EPSS
0%
Percentile
10.2
In the wild
Unconfirmed
What it is

Gokapi is a self-hosted file sharing server with automatic expiration and encryption support. Prior to 2.2.4, An insufficient authorization check in the file replace API allows a user with only list visibility permission (UserPermListOtherUploads) to delete another user's file by abusing the deleteNewFile flag, bypassing the requirement for UserPermDeleteOtherUploads. This vulnerability is fixed in 2.2.4.

The record
Technical detail
CVSS v3.1
4.1 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00207 · 10.2th percentile
Weakness
CWE-863 · Incorrect Authorization
Published
2026-03-13T19:07Z
EPSS history
Timeline
  • 13 MAR 19:07Z
    Gokapi has Privilege Escalation in File Replace
    cvelistv5