CVE-2026-29060
📋 TL;DR
In Gokapi versions before 2.2.3, registered users without proper privileges can create short-lived API keys with elevated permissions to create or modify file requests. This affects all Gokapi instances with registered users, but only has impact if no admin/upload users exist.
💻 Affected Systems
- Gokapi
📦 What is this software?
Gokapi by Forceu
⚠️ Risk & Real-World Impact
Worst Case
Unauthorized users gain ability to create/modify file requests, potentially exposing sensitive files or disrupting file sharing operations.
Likely Case
Limited privilege escalation allowing unauthorized file request creation, but requires existing user registration.
If Mitigated
No impact if proper user privilege controls are enforced or if no admin/upload users exist.
🎯 Exploit Status
Exploitation requires authenticated user access and knowledge of API endpoints.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.2.3
Vendor Advisory: https://github.com/Forceu/Gokapi/security/advisories/GHSA-m2hx-wjxc-9fp4
Restart Required: Yes
Instructions:
1. Backup your Gokapi configuration and data. 2. Download Gokapi v2.2.3 from GitHub releases. 3. Replace existing Gokapi installation with new version. 4. Restart the Gokapi service.
🔧 Temporary Workarounds
Disable user registration
allPrevent new user registrations to eliminate attack vector.
Edit Gokapi configuration to disable user registration feature
Restrict API key creation
allImplement access controls to limit API key creation to admin users only.
Configure Gokapi to require admin privileges for API key management
🧯 If You Can't Patch
- Implement strict user privilege review and monitoring
- Disable API key functionality for non-admin users
🔍 How to Verify
Check if Vulnerable:
Check Gokapi version - if version is less than 2.2.3, system is vulnerable.Check Version:
Check Gokapi web interface or configuration file for version informationVerify Fix Applied:
Verify Gokapi version is 2.2.3 or higher after patching.📡 Detection & Monitoring
Log Indicators:
- Unauthorized API key creation events
- File request creation from non-privileged users
Network Indicators:
- API calls to create/modify file requests from unexpected user accounts
SIEM Query:
source="gokapi" AND (event="api_key_created" OR event="file_request_created") AND user_role!="admin"