| Package | Affected versions | Patched versions |
|---|---|---|
| github.com/forceu/gokapi | < 2.2.4all versions | 2.2.4 |
| gokapi | < 2.2.4 | 2.2.4 |
An insufficient authorization check in the file replace API allows a user with only list visibility permission (UserPermListOtherUploads) to delete another user's file by abusing the deleteNewFile flag, bypassing the requirement for UserPermDeleteOtherUploads.
Any authenticated user with PERM_REPLACE (replace own files) and PERM_LIST (view other users' uploads) can delete any other user's file without needing PERM_DELETE.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free