Beschreibung
Seahub before 13.0.23 does not enforce SHARE_LINK_LOGIN_REQUIRED on GET /api/v2.1/share-link-zip-task/, allowing unauthenticated users to bypass authentication. Attackers with a folder share-link token can call the GET endpoint to obtain a fileserver zip token and download entire shared directory trees.
CVSS 8.8EPSS 0.381%Risiko 0.91
Quelle öffnen- Veröffentlicht
- 2026-06-25 19:16:43
- Betroffene Versionen
- <13.0.23
- Typ
- Webanwendung
- Vektor
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H