XBackBone Auth Bypass via Vanity Code Manipulation

Executive Summary

CVE-2026-110230 is a missing authorization vulnerability in XBackBone through version 3.8.2. It allows authenticated users to change the vanity share codes (URLs) of other users' uploads via the POST /upload/{id}/vanity endpoint. The flaw exists in the MediaController::createVanity() function, which did not verify ownership of the upload before allowing modifications. Attackers could exploit sequential upload IDs to break existing share links and hijack freed vanity codes by uploading their own files.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if your XBackBone instance allows authenticated users to modify vanity URLs of other users' uploads without proper ownership checks. Test by sending a POST request to /upload/{id}/vanity with a known upload ID belonging to another user. If the request succeeds without admin or ownership verification, the system is vulnerable.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows unauthorized users to modify or invalidate share links of other users' uploads. If you use XBackBone to share files via vanity URLs, an attacker could break your public links, replace your content with their own, or disrupt access to your shared files. This affects integrity and availability of your shared media, especially if embedded in external systems.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could impact compliance with data protection regulations like GDPR and HIPAA by enabling unauthorized access to or modification of shared files. GDPR requires protecting personal data integrity and access controls, while HIPAA mandates strict access controls for health information. Unauthorized vanity URL changes could violate these requirements, leading to data breaches or unauthorized exposure of sensitive information.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update XBackBone to a version beyond 3.8.2 where the fix has been applied. Ensure the MediaController::createVanity() function enforces ownership checks by scoping upload lookups to the current user's ID for non-administrators. Verify the fix by testing unauthorized vanity URL modifications.

Useful 0 Not Useful 0