medium4.1
CVE-2026-30943
Gokapi vulnerable to Privilege Escalation in File Replace
Impact
## Summary An insufficient authorization check in the file replace API allows a user with only list visibility permission (`UserPermListOtherUploads`) to delete another user's file by abusing the `deleteNewFile` flag, bypassing the requirement for `UserPermDeleteOtherUploads`. ### Impact Any authenticated user with `PERM_REPLACE` (replace own files) and `PERM_LIST` (view other users' uploads) can delete any other user's file without needing `PERM_DELETE`.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| go | github.com/forceu/gokapi | <= 2.2.3 | 2.2.4 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Forceu | Gokapi | before 2.2.4 |