GHSA-c36c-7pc2-f2ph

Source

https://github.com/advisories/GHSA-c36c-7pc2-f2ph

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-c36c-7pc2-f2ph/GHSA-c36c-7pc2-f2ph.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-c36c-7pc2-f2ph

Aliases

Published

2026-03-05T18:37:48Z

Modified

2026-03-23T04:56:11.102489762Z

Severity

6.4 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N CVSS Calculator

Summary

Gokapi has Data Leak in Upload Status Stream

Details

Description

The upload status SSE implementation on /uploadStatus publishes global upload state to any authenticated listener and includes file_id values that are not scoped to the requesting user.

Impact

Any authenticated user can observe other users' file identifiers and retrieve unauthorized content, causing cross-tenant data exposure and loss of confidentiality for uploaded documents.

Issue found by aisafe.io

Database specific

{
    "github_reviewed": true,
    "severity": "MODERATE",
    "nvd_published_at": "2026-03-06T05:16:38Z",
    "cwe_ids": [
        "CWE-200",
        "CWE-284"
    ],
    "github_reviewed_at": "2026-03-05T18:37:48Z"
}

References

Affected packages

Go / github.com/forceu/gokapi

Package

Name: github.com/forceu/gokapi; View open source insights on deps.dev
Purl: pkg:golang/github.com/forceu/gokapi

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.2.3

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-c36c-7pc2-f2ph/GHSA-c36c-7pc2-f2ph.json"