Improper authorization control for web services In github.com/forceu/gokapi
Description
Gokapi has Data Leak in Upload Status Stream
Description
The upload status SSE implementation on /uploadStatus publishes global upload state to any authenticated listener and includes file_id values that are not scoped to the requesting user.
Impact
Any authenticated user can observe other users' file identifiers and retrieve unauthorized content, causing cross-tenant data exposure and loss of confidentiality for uploaded documents.
Issue found by aisafe.io
Mitigation
Update Impact
Minimal update. May introduce new vulnerabilities or breaking changes.
Ecosystem | Package | Affected version | Patched versions |
|---|---|---|---|
 go | 2.2.3 |
Aliases
1. 2. 3. 4. 5.
References
1. 2.