CVE-2026-126948
Received Received - Intake

Zipline Unauthenticated Folder Manipulation via IDOR

Publication date: 2026-11-13

Last updated on: 2026-11-13

Assigner: VulnCheck

Description
Zipline before 4.5.0 contains an insecure direct object reference vulnerability caused by missing ownership verification in the PATCH and DELETE handlers for /api/user/folders/:id. Authenticated attackers can supply another user's folder ID to rename it, make it public, enable uploads, or delete it.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-13
Last Modified
2026-11-13
Generated
2026-11-13
AI Q&A
2026-11-13
EPSS Evaluated
N/A
NVD
CVE-2026-126948
EUVD
EUVD-2026-125117

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
zipline zipline to 4.5.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an Insecure Direct Object Reference (IDOR) in Zipline before version 4.5.0. It affects the PATCH and DELETE handlers for /api/user/folders/:id. Authenticated attackers can manipulate or delete another user's folders by supplying their folder ID without proper ownership verification. This allows actions like renaming folders, making them public, enabling uploads, or deleting them entirely.

Detection Guidance

To detect this vulnerability, inspect network traffic for unauthorized PATCH or DELETE requests to /api/user/folders/:id endpoints. Check logs for requests where the folder ID does not belong to the authenticated user. Use tools like curl to test endpoints manually: curl -X PATCH http://target/api/user/folders/123 -H 'Authorization: Bearer token' -d '{"name":"newname"}' and verify if unauthorized modifications succeed.

Impact Analysis

If exploited, this vulnerability could lead to unauthorized access and modification of your folders. Attackers could delete important folders, change their settings, or make private folders public. This could result in data loss, exposure of sensitive information, or disruption of service for affected users.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR and HIPAA by allowing unauthorized access to and modification of user data. GDPR requires protecting personal data, while HIPAA mandates safeguarding protected health information. Exploitation could result in data breaches, leading to legal penalties and reputational damage.

Mitigation Strategies

Immediately upgrade Zipline to version 4.5.0 or later. If upgrading is not possible, apply a patch to add ownership verification to the PATCH and DELETE endpoints. Ensure the folderExistsAndEditable preHandler is used in these routes. Temporarily restrict access to these endpoints via firewall rules until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-126948. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...