SB20260408130 - Authorization bypass through user-controlled key in FileBrowser

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB20260408130

SB20260408130 - Authorization bypass through user-controlled key in FileBrowser

Published: April 8, 2026

Security Bulletin ID SB20260408130
Severity
Medium
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

Medium 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 security vulnerability.


1) Authorization bypass through user-controlled key (CVE-ID: CVE-2025-64523)

The vulnerability allows a remote user to delete other users' shared links.

The vulnerability exists due to authorization bypass through user-controlled key in the share deletion function in /http/share.go when handling share deletion requests by share hash. A remote user can send a crafted delete request for another user's share hash to delete other users' shared links.

The issue affects the shareDeleteHandler because it does not compare the share owner's user ID with the current authenticated user's ID before deletion.


Remediation

Install update from vendor's website.

References