medium5.4
CVE-2026-29061
Gokapi has privilege escalation via incomplete API-key permission revocation on user rank demotion
Impact
### Summary A privilege escalation vulnerability in the user rank demotion logic allows a demoted user's existing API keys to retain ApiPermManageFileRequests and ApiPermManageLogs permissions, enabling continued access to upload-request management and log viewing endpoints after the user has been stripped of all privileges. ### Impact Any user who previously held Admin rank and had API keys with ApiPermManageFileRequests or ApiPermManageLogs retains those capabilities after demotion. This allows offboarded or demoted users to: - Create, list, and delete upload requests - Read application logs and system status
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| go | github.com/forceu/gokapi | < 2.2.3 | 2.2.3 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Forceu | Gokapi | before 2.2.3 |