GHSA-j6jp-78w8-34x6
Gokapi vulnerable to Privilege Escalation in File Replace
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Go | github.com/forceu/gokapi | < 2.2.4 | 2.2.4 |
Details
As written in the advisory (Markdown source, shown as plain text).
## Summary
An insufficient authorization check in the file replace API allows a user with only list visibility permission (`UserPermListOtherUploads`) to delete another user's file by abusing the `deleteNewFile` flag, bypassing the requirement for `UserPermDeleteOtherUploads`.
### Impact
Any authenticated user with `PERM_REPLACE` (replace own files) and `PERM_LIST` (view other users' uploads) can delete any other user's file without needing `PERM_DELETE`.
References
External links from the advisory. They lead to third-party sites.