CVE-2026-76032
Received Received - Intake

Pydio Cells Unauthorized Share Link Information Disclosure

Publication date: 2026-08-18

Last updated on: 2026-08-18

Assigner: VulnCheck

Description
Pydio Cells 5.0.0 through 5.0.2 returns share-link details to any authenticated user. The REST handler for GET /a/share/link/{Uuid} in idm/share/rest/handler.go reads the workspace UUID from the path, calls LinkById, and writes the result with no authorization step, whereas the sibling handler for GET /a/share/cell/{Uuid} loads the workspace and requires MatchPolicies with ResourcePolicyAction_READ, returning a not-found error so that existence is not disclosed. Nothing compensates further down: GetLinkWorkspace reaches GetOrCreateWorkspace, which issues SearchWorkspace with a query carrying no ResourcePolicyQuery, and PrepareResourcePolicyQuery returns the query unmodified when that field is nil, so the workspace service applies no policy filter. The workspace UUID is not secret, because the unauthenticated public page served for a share link embeds it as START_REPOSITORY. Any account holding a standard user role can therefore submit the UUID and receive the link hash and URL, the owner's user identifier, the hidden share user login, the permission set, the download limit and count, the target users, the expiry, and the password-required flag, while a direct read of the shared node from the same account is refused.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-18
Last Modified
2026-08-18
Generated
2026-08-19
AI Q&A
2026-08-18
EPSS Evaluated
N/A
NVD
CVE-2026-76032
EUVD
EUVD-2026-61205

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
pydio cells From 5.0.0 (inc) to 5.0.2 (inc)
pydio cells 5.0.2

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in Pydio Cells 5.0.0 through 5.0.2 allows any authenticated user to access sensitive share-link details without proper authorization. The REST handler for GET /a/share/link/{Uuid} returns link information like hash, URL, owner details, permissions, and expiry without checking user permissions. The issue stems from improper policy enforcement in the workspace service where ResourcePolicyQuery is not applied correctly.

Detection Guidance

To detect this vulnerability, check if your Pydio Cells instance is running version 5.0.0 through 5.0.2. Inspect network traffic for unauthorized access to GET /a/share/link/{Uuid} endpoints. Review logs for requests to these endpoints from non-admin users. Verify if standard users can retrieve share-link details like hashes, URLs, or workspace UUIDs without proper authorization.

Impact Analysis

An attacker with a standard user account could exploit this to access confidential share-link data, including file URLs, owner identifiers, permission settings, and download limits. This could lead to unauthorized data access, data leaks, or potential manipulation of shared resources if combined with other vulnerabilities.

Compliance Impact

This vulnerability likely violates compliance requirements for data protection regulations like GDPR and HIPAA, which mandate strict access controls and protection of sensitive data. Unauthorized access to shared resources could result in data breaches, leading to legal penalties, reputational damage, and loss of trust.

Mitigation Strategies

Upgrade Pydio Cells to a patched version immediately. Temporarily restrict access to the /a/share/link/{Uuid} endpoint via firewall rules. Audit all share links and revoke any potentially exposed permissions. Monitor for unusual activity in shared workspaces or policy changes.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-76032. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart