Popis
Seahub before 13.0.23 does not enforce SHARE_LINK_LOGIN_REQUIRED on GET /api/v2.1/share-link-zip-task/, allowing unauthenticated users to bypass authentication. Attackers with a folder share-link token can call the GET endpoint to obtain a fileserver zip token and download entire shared directory trees.
CVSS 8.8EPSS 0.381%Riziko 0.91
Zobraziť zdroj- Zverejnené
- 2026-06-25 19:16:43
- Dotknuté verzie
- <13.0.23
- Typ
- Webová aplikácia
- Vektor
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H