CVE-2026-76032: Pydio Cells Information Disclosure Flaw

CVE-2026-76032 Overview

CVE-2026-76032 is a missing authorization vulnerability [CWE-862] in Pydio Cells versions 5.0.0 through 5.0.2. The REST handler for GET /a/share/link/{Uuid} in idm/share/rest/handler.go returns share-link details to any authenticated user without performing an authorization check. Attackers holding a standard user role can submit a workspace UUID, which is not secret because the unauthenticated public share page embeds it as START_REPOSITORY, and receive sensitive share metadata. The disclosed data includes the link hash and URL, the owner's user identifier, the hidden share user login, the permission set, download limit and count, target users, expiry, and the password-required flag.

Critical Impact
Any authenticated user can enumerate and read metadata for any share link in the deployment, exposing owner identity, credentials indicators, permissions, and expiry data across tenants.

Affected Products

Pydio Cells 5.0.0
Pydio Cells 5.0.1
Pydio Cells 5.0.2

Discovery Timeline

2026-08-18 - CVE-2026-76032 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-76032

Vulnerability Analysis

The flaw resides in the share subsystem of Pydio Cells. The handler for GET /a/share/link/{Uuid} reads the workspace UUID from the request path, invokes LinkById, and writes the response directly to the caller. No authorization step is executed before the data is returned. This behavior contrasts with the sibling handler for GET /a/share/cell/{Uuid}, which loads the workspace and enforces MatchPolicies with ResourcePolicyAction_READ, and returns a not-found error to avoid disclosing existence.

Downstream layers do not compensate for the missing check. GetLinkWorkspace reaches GetOrCreateWorkspace, which issues SearchWorkspace with a query that carries no ResourcePolicyQuery. The helper PrepareResourcePolicyQuery returns the query unmodified when that field is nil, so the workspace service applies no policy filter. The result is a broken access control condition where a direct read of the shared node is refused, yet the share metadata is leaked freely.

Root Cause

The root cause is a missing authorization check on the share-link REST handler, combined with a permissive default in PrepareResourcePolicyQuery that silently disables policy filtering when the resource policy query is nil.

Attack Vector

An authenticated user with a standard role obtains a workspace UUID from the public share page, where it is embedded as START_REPOSITORY, then issues a GET request to /a/share/link/{Uuid}. The service returns the full share-link record without validating that the caller is the owner or has read permission on the underlying resource.

No exploit code is required beyond an authenticated HTTP request. Refer to the VulnCheck Pydio Cells Advisory and the Share Handler source for the specific code path.

Detection Methods for CVE-2026-76032

Indicators of Compromise

Repeated authenticated GET /a/share/link/{Uuid} requests from a single low-privilege account against multiple distinct workspace UUIDs.
Access log entries where the requesting user is not the share owner returned by the handler response body.
Requests to /a/share/link/ originating from accounts that have no history of creating or managing shares.

Detection Strategies

Ingest Pydio Cells REST access logs into a centralized log platform and alert on high-cardinality UUID enumeration against the /a/share/link/ endpoint.
Correlate share-link reads with the requesting user identity; flag responses whose owner field does not match the caller.
Baseline normal share API usage per user role, and identify deviations such as bursts of link lookups from standard users.

Monitoring Recommendations

Enable verbose audit logging on the idm/share service and forward events to your SIEM.
Monitor for unauthenticated retrieval of public share pages followed by authenticated /a/share/link/{Uuid} calls from the same source IP.
Track anomalies in the ratio of share metadata reads to actual node access, since successful reads without corresponding node access indicate exploitation.

How to Mitigate CVE-2026-76032

Immediate Actions Required

Upgrade Pydio Cells to a version later than 5.0.2 once the vendor releases a fix that adds authorization to the share-link handler.
Restrict account creation and audit existing standard user accounts, since exploitation requires only authenticated access.
Rotate share links that expose sensitive content and reset passwords for password-protected shares that may have been enumerated.

Patch Information

At the time of publication, monitor the Pydio Cells repository and GitHub Issue #981 for a release addressing the missing MatchPolicies call in the share-link handler and the nil-safe behavior of PrepareResourcePolicyQuery.

Workarounds

Place Pydio Cells behind a reverse proxy and block direct external access to /a/share/link/{Uuid} for non-administrative users pending a patch.
Reduce the population of standard user accounts on internet-exposed instances and require SSO or MFA to raise the exploitation barrier.
Review and remove shares that contain sensitive owner or target user metadata that would be damaging if enumerated.

bash

# Example reverse proxy rule (nginx) restricting the vulnerable endpoint
# Restrict /a/share/link/ to trusted admin IP ranges until patched
location ~ ^/a/share/link/ {
    allow 10.0.0.0/24;
    deny all;
    proxy_pass http://pydio_cells_backend;
}