CVE-2026-28682

Published: Mar 6, 2026Modified: Jun 17, 2026

6.4

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Exploitability: 3.1 / Impact: 2.7

Source: NVD

Description

Gokapi is a self-hosted file sharing server with automatic expiration and encryption support. Prior to version 2.2.3, the upload status SSE implementation on /uploadStatus publishes global upload state to any authenticated listener and includes file_id values that are not scoped to the requesting user. This issue has been patched in version 2.2.3.

Affected (1)

Products: Forceu: Gokapi

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Forceu Gokapi	Before 2.2.3

Related CWEs

Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Improper Access Control

The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

References (2)

https://github.com/Forceu/Gokapi/releases/tag/v2.2.3

Source: security-advisories@github.com

Release Notes

https://github.com/Forceu/Gokapi/security/advisories/GHSA-c36c-7pc2-f2ph

Source: security-advisories@github.com

Vendor Advisory

Timeline

No history available yet.