CVE-2026-30943

Published March 13th, 2026

View on NVD ↗

CVSS v3

4.1

MEDIUM

CVSS v2

N/A

Affected

PROJECT

Description

Gokapi is a self-hosted file sharing server with automatic expiration and encryption support. Prior to 2.2.4, An insufficient authorization check in the file replace API allows a user with only list visibility permission (UserPermListOtherUploads) to delete another user's file by abusing the deleteNewFile flag, bypassing the requirement for UserPermDeleteOtherUploads. This vulnerability is fixed in 2.2.4.

Forceu/Gokapi

Lightweight selfhosted Firefox Send alternative without public upload. AWS S3 supported.

GitHub

2.75K