[CVE-2026-56768] Seahub before 13.0.23 does not enforce SHARE_LINK_LOGIN_REQUIRED on GET /api/v2.1/share-link-zip-tas…

Descripción técnica

Seahub before 13.0.23 does not enforce SHARE_LINK_LOGIN_REQUIRED on GET /api/v2.1/share-link-zip-task/, allowing unauthenticated users to bypass authentication. Attackers with a folder share-link token can call the GET endpoint to obtain a fileserver zip token and download entire shared directory trees.

Puntuación CVSS

Score: 8.8/10 — Severidad: HIGH — Estado NIST: Deferred

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Debilidades (CWE)

CWE-862

Fuente oficial

Publicado en NIST NVD.