VDB
CVE-2026-30943
CVE-2026-30943
PUBLISHED
CVSS 4.1 MEDIUM
Gokapi has Privilege Escalation in File Replace
Reported by github_m · Published March 13, 2026
Gokapi is a self-hosted file sharing server with automatic expiration and encryption support. Prior to 2.2.4, An insufficient authorization check in the file replace API allows a user with only list visibility permission (UserPermListOtherUploads) to delete another user's file by abusing the deleteNewFile flag, bypassing the requirement for UserPermDeleteOtherUploads. This vulnerability is fixed in 2.2.4.
Risk scores
CVSS 3.1
4.1
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:L/A:N
Affected products
| Vendor | Product | Versions |
|---|---|---|
| Forceu | Gokapi | < 2.2.4 |
| Forceu | Gokapi | 0 |
| github.com | forceu/gokapi | 0 |
Timeline
- Mar 13, 2026 CVE Published
- Mar 14, 2026 EPSS Score (30 in total, the first dated here)
- Mar 17, 2026 Coalition ESS Score (2 in total, the first dated here)
- Mar 17, 2026 CVE Updated
- Mar 25, 2026 Security Advisory
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln CVE-2026-30943
vulnetix vdb fixes CVE-2026-30943Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/CVE-2026-30943/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart
References
- https://github.com/Forceu/Gokapi/security/advisories/GHSA-j6jp-78w8-34x6 x_refsource_CONFIRM
- https://github.com/Forceu/Gokapi/releases/tag/v2.2.4 x_refsource_MISC
- https://nvd.nist.gov/vuln/detail/CVE-2026-30943 advisory
- https://github.com/advisories/GHSA-j6jp-78w8-34x6 advisory
- https://github.com/Forceu/Gokapi url
- https://pkg.go.dev/vuln/GO-2026-4696 url