CVE-2026-82582
Deferred Deferred - Pending Action

Authorization Bypass in SHIRASAGI via User-Controlled Key

Publication date: 2026-09-10

Last updated on: 2026-09-10

Assigner: JPCERT/CC

Description
An authorization bypass vulnerability exists in SHIRASAGI through a user-controlled key, which may allow an unauthorized attacker to retrieve files from the groupware's shared file feature.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-10
Last Modified
2026-09-10
Generated
2026-09-30
AI Q&A
2026-09-10
EPSS Evaluated
2026-09-29
NVD
CVE-2026-82582
EUVD
EUVD-2026-75272

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
shirasagi shirasagi From 1.14.0 (inc) to 1.20.2 (inc)
shirasagi shirasagi to 1.20.2 (exc)
shirasagi shirasagi From 1.21.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is an authorization bypass vulnerability in SHIRASAGI where an attacker can exploit a user-controlled key to access files in the groupware's shared file feature without proper permissions.

Detection Guidance

To detect this vulnerability, check if your SHIRASAGI instance is running a version earlier than v1.21.0. Verify the version via the admin panel or by examining the application files. If vulnerable, unauthorized users may access shared files by manipulating user-controlled keys.

Impact Analysis

An unauthorized attacker could retrieve sensitive files from the shared file feature, potentially exposing confidential or proprietary data stored in the groupware.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating GDPR's data protection principles and HIPAA's security rules for protected health information.

Mitigation Strategies

Update SHIRASAGI to version v1.21.0 or later to address the authorization bypass vulnerability. If updating is not immediately possible, apply the provided commit fixes.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-82582. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart