CVE-2026-29061
Reported by github_m · Published March 6, 2026
github.com/forceu/gokapi is fixed in 2.2.3 (Go Modules)
Gokapi is a self-hosted file sharing server with automatic expiration and encryption support. Prior to version 2.2.3, a privilege escalation vulnerability in the user rank demotion logic allows a demoted user's existing API keys to retain ApiPermManageFileRequests and ApiPermManageLogs permissions, enabling continued access to upload-request management and log viewing endpoints after the user has been stripped of all privileges. This issue has been patched in version 2.2.3.
Fixed versions
Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.
| Package | Ecosystem | Fixed in |
|---|---|---|
| github.com/forceu/gokapi | Go Modules | 2.2.3 |
| gokapi | forceu | 2.2.3 |
Risk scores
Affected products
| Vendor | Product | Versions |
|---|---|---|
| Forceu | Gokapi | < 2.2.3 |
| github.com | forceu/gokapi | 0 |
| Forceu | Gokapi | 0 |
Timeline
- Mar 5, 2026 CVE Published
- Mar 6, 2026 EPSS Score (30 in total, the first dated here)
- Mar 6, 2026 CVE Updated
- Mar 17, 2026 Coalition ESS Score (2 in total, the first dated here)
- Mar 17, 2026 Security Advisory
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln CVE-2026-29061
vulnetix vdb fixes CVE-2026-29061Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/CVE-2026-29061/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart
References
- https://github.com/Forceu/Gokapi/security/advisories/GHSA-q658-hfpg-35qc x_refsource_CONFIRM
- https://github.com/Forceu/Gokapi/releases/tag/v2.2.3 x_refsource_MISC
- https://nvd.nist.gov/vuln/detail/CVE-2026-29061 advisory
- https://github.com/advisories/GHSA-q658-hfpg-35qc advisory
- https://github.com/Forceu/Gokapi url