Moderate severityNVD Advisory· Published Mar 6, 2026· Updated Mar 6, 2026
Gokapi: Privilege escalation via incomplete API-key permission revocation on user rank demotion
CVE-2026-29061
Description
Gokapi is a self-hosted file sharing server with automatic expiration and encryption support. Prior to version 2.2.3, a privilege escalation vulnerability in the user rank demotion logic allows a demoted user's existing API keys to retain ApiPermManageFileRequests and ApiPermManageLogs permissions, enabling continued access to upload-request management and log viewing endpoints after the user has been stripped of all privileges. This issue has been patched in version 2.2.3.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
github.com/forceu/gokapiGo | < 2.2.3 | 2.2.3 |
Affected products
1Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
4- github.com/advisories/GHSA-q658-hfpg-35qcghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2026-29061ghsaADVISORY
- github.com/Forceu/Gokapi/releases/tag/v2.2.3ghsax_refsource_MISCWEB
- github.com/Forceu/Gokapi/security/advisories/GHSA-q658-hfpg-35qcghsax_refsource_CONFIRMWEB
News mentions
0No linked articles in our index yet.