CVE-2026-30943: Forceu Gokapi Auth Bypass Vulnerability

CVE-2026-30943 Overview

CVE-2026-30943 is an authorization bypass vulnerability in Gokapi, a self-hosted file sharing server that provides automatic expiration and encryption support. Prior to version 2.2.4, an insufficient authorization check in the file replace API allows a user with only list visibility permission (UserPermListOtherUploads) to delete another user's file by abusing the deleteNewFile flag, bypassing the requirement for UserPermDeleteOtherUploads. This vulnerability enables unauthorized file deletion through improper access control validation.

Critical Impact

Authenticated users with minimal permissions can delete files belonging to other users, potentially causing data loss and disrupting file sharing operations in self-hosted Gokapi deployments.

Affected Products

• Forceu Gokapi versions prior to 2.2.4

Discovery Timeline

• 2026-03-13 - CVE CVE-2026-30943 published to NVD
• 2026-03-17 - Last updated in NVD database

Technical Details for CVE-2026-30943

Vulnerability Analysis

This vulnerability is classified as CWE-863 (Incorrect Authorization), representing a fundamental access control flaw in how Gokapi validates user permissions during file replacement operations. The file replace API endpoint fails to properly verify that the requesting user possesses the UserPermDeleteOtherUploads permission before allowing file deletion actions. Instead, the API only checks for UserPermListOtherUploads, a significantly less privileged permission intended solely for viewing file listings.

The attack can be executed remotely by an authenticated user with network access to the Gokapi server. The exploitation requires high-level privileges in terms of being an authenticated user, but the actual permission level needed (list visibility only) is much lower than what should be required for deletion operations. The vulnerability affects the integrity of other users' data without impacting confidentiality or availability beyond the deleted files.

Root Cause

The root cause lies in insufficient authorization checks within the file replace API implementation. When processing file replacement requests with the deleteNewFile flag enabled, the code path validates the user's UserPermListOtherUploads permission but fails to additionally verify UserPermDeleteOtherUploads before executing the deletion operation. This creates a privilege escalation path where users can perform destructive actions beyond their intended permission scope.

Attack Vector

An authenticated attacker with only the UserPermListOtherUploads permission can exploit this vulnerability by crafting a malicious file replace API request. By setting the deleteNewFile flag in the request, the attacker can trigger file deletion logic that should be gated behind the UserPermDeleteOtherUploads permission. The attack is performed over the network against the Gokapi web API, requiring no user interaction and resulting in unauthorized deletion of files owned by other users.

The exploitation flow involves:

1. Authenticating to the Gokapi server with a low-privileged account that has UserPermListOtherUploads
2. Identifying target files owned by other users through the list functionality
3. Sending a crafted file replace API request with the deleteNewFile flag set to true
4. The server processes the deletion without verifying UserPermDeleteOtherUploads, resulting in unauthorized file removal

Detection Methods for CVE-2026-30943

Indicators of Compromise

• Unexpected file deletions by users who lack UserPermDeleteOtherUploads permission
• API logs showing file replace requests with deleteNewFile flag from low-privileged accounts
• Audit trails indicating files deleted by users other than the file owner without proper delete permissions
• Increased file replace API activity from accounts with limited permission sets

Detection Strategies

• Monitor API access logs for file replace endpoint calls that include the deleteNewFile parameter
• Implement alerting on file deletion events where the acting user lacks UserPermDeleteOtherUploads permission
• Review user permission assignments and cross-reference with deletion activity logs
• Deploy application-layer logging to capture authorization check results for sensitive operations

Monitoring Recommendations

• Enable verbose logging for all file management API endpoints in Gokapi
• Set up alerts for anomalous patterns in file deletion activity, particularly by users with restricted permissions
• Regularly audit user permissions and compare against expected access control policies
• Monitor for repeated file replace API calls from the same user targeting multiple file owners

How to Mitigate CVE-2026-30943

Immediate Actions Required

• Upgrade Gokapi to version 2.2.4 or later immediately to apply the security fix
• Review recent API logs for potential exploitation attempts using the file replace endpoint
• Audit all user accounts with UserPermListOtherUploads permission for any unauthorized deletion activity
• Consider temporarily restricting access to the file replace API until the patch is applied

Patch Information

The vulnerability has been fixed in Gokapi version 2.2.4. The patch addresses the insufficient authorization check by properly validating that users possess the UserPermDeleteOtherUploads permission before allowing file deletion operations through the file replace API. Administrators should upgrade to this version or later to remediate the vulnerability.

For detailed information about the fix, refer to:

• Gokapi Release v2.2.4
• GitHub Security Advisory GHSA-j6jp-78w8-34x6

Workarounds

• Restrict the UserPermListOtherUploads permission to only trusted administrative users until the patch can be applied
• Implement network-level access controls to limit which users can reach the Gokapi API endpoints
• Consider deploying a web application firewall (WAF) rule to block file replace API requests containing the deleteNewFile parameter from non-administrative accounts
• Disable the file replace functionality entirely if it is not required for business operations

# Verify Gokapi version after upgrade
gokapi --version
# Expected output: 2.2.4 or higher

# Review API logs for potential exploitation (example path may vary)
grep -i "deleteNewFile" /var/log/gokapi/api.log