CVE-2026-29060
Privilege Escalation via API Key in Gokapi File Server
Publication date: 2026-03-06
Last updated on: 2026-03-09
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| forceu | gokapi | to 2.2.3 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-284 | The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-29060 is a moderate severity privilege escalation vulnerability in the Gokapi file sharing server versions prior to 2.2.3.
It allows a registered user who normally does not have privileges to create or modify file requests to generate a short-lived API key that grants these elevated permissions.
This happens due to improper access control, meaning the system fails to properly restrict access to certain actions from unauthorized users.
The vulnerability can be exploited remotely over the network with low complexity and does not require any user interaction.
If no users have access to the admin/upload menu, the vulnerability has no impact.
The issue was fixed in Gokapi version 2.2.3.
How can this vulnerability impact me? :
This vulnerability can allow a registered user without proper privileges to temporarily gain the ability to create or modify file requests by generating a short-lived API key.
While it does not affect confidentiality or integrity, it can impact availability by allowing unauthorized changes to file requests.
If your system has users with access to the admin/upload menu, this vulnerability could be exploited to disrupt normal operations.
If no users have such access, the vulnerability does not have an impact.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
I don't know
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, you should upgrade Gokapi to version 2.2.3 or later, where the issue has been patched.
Additionally, ensure that there are users with access to the admin/upload menu, as the vulnerability has no impact if no users have such access.