MEDIUM 6.3 NVD
CVE-2026-111332
OxiCloud 0.9.1 through 0.9.3 contains an incorrect authorization vulnerability that allows anonymous visitors to keep share access after password protection is
OxiCloud 0.9.1 through 0.9.3 contains an incorrect authorization vulnerability that allows anonymous visitors to keep share access after password protection is added. Attackers holding an existing oxi_shares share-ring cookie can request content via GET /api/files/{id} to read shared files or folder contents despite the new password.
References
- https://github.com/AtalayaLabs/OxiCloud
- https://github.com/AtalayaLabs/OxiCloud/blob/v0.9.3/src/application/services/share_service
- https://github.com/AtalayaLabs/OxiCloud/blob/v0.9.3/src/infrastructure/services/share_ring
- https://hackmd.io/@hieuPenguinnn/oxicloud-share-password-grant-not-revoked
- https://www.vulncheck.com/advisories/oxicloud-0.9.1-through-0.9.3-incorrect-authorization-
This medium severity vulnerability with a CVSS score of 6.3 was published on 2026-10-15 via NVD.
vulnfeed aggregates 14677 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.