CVE-2026-126948

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-126948

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-126948.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-126948

Aliases

GHSA-fgwh-2pc5-wr73

Published

2026-11-13T09:34:33Z

Modified

2026-11-15T02:46:24Z

Severity

8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator

Summary

Zipline before 4.5.0 IDOR via Folder PATCH and DELETE Endpoints

Details

Zipline before 4.5.0 contains an insecure direct object reference vulnerability caused by missing ownership verification in the PATCH and DELETE handlers for /api/user/folders/:id. Authenticated attackers can supply another user's folder ID to rename it, make it public, enable uploads, or delete it.

Database specific

{
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
        "CWE-639"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/126xxx/CVE-2026-126948.json"
}

References

Affected packages

Git / github.com/diced/zipline

Affected ranges

Type

GIT

Repo

https://github.com/diced/zipline

Events

Introduced

Fixed

d8ca9dc9b5a7dfc11374e50a591a72c8b47cc2af

Database specific

Show details

{
    "extracted_events": [
        {
            "range": [
                {
                    "introduced": "0"
                },
                {
                    "fixed": "4.5.0"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandardRange"
        },
        {
            "range": [
                {
                    "introduced": "0"
                },
                {
                    "fixed": "4.5.0"
                }
            ],
            "source": "DESCRIPTION"
        }
    ]
}

Affected versions

v4.*

v4.0.0

v4.0.1

v4.0.2

v4.1.0

v4.1.1

v4.1.2

v4.2.0

v4.2.1

v4.2.2

v4.2.3

v4.3.0

v4.3.1

v4.3.2

v4.4.0

v4.4.1

v4.4.2

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-126948.json"