~ / search / GHSA-q658-hfpg-35qc

GHSA-q658-hfpg-35qc

Gokapi has privilege escalation via incomplete API-key permission revocation on user rank demotion

Source: GitHub Advisory Database (reviewed) Moderate CVE-2026-29061

Packages

EcosystemPackageAffectedFixed in
Go github.com/forceu/gokapi < 2.2.3 2.2.3

Details

As written in the advisory (Markdown source, shown as plain text).

### Summary A privilege escalation vulnerability in the user rank demotion logic allows a demoted user's existing API keys to retain ApiPermManageFileRequests and ApiPermManageLogs permissions, enabling continued access to upload-request management and log viewing endpoints after the user has been stripped of all privileges. ### Impact Any user who previously held Admin rank and had API keys with ApiPermManageFileRequests or ApiPermManageLogs retains those capabilities after demotion. This allows offboarded or demoted users to: - Create, list, and delete upload requests - Read application logs and system status

References

External links from the advisory. They lead to third-party sites.