Gokapi Data Leak Vulnerability in Upload Status Stream

A data leak vulnerability has been identified in Gokapi, a self-hosted file sharing server, prior to version 2.2.3. The issue arises in the upload status Server-Sent Events (SSE) implementation on the '/uploadStatus' endpoint, which broadcasts global upload states to all authenticated listeners. This transmission includes 'file_id' values that are not restricted to the user's own uploads. As a result, any authenticated user can access other users' file identifiers and unauthorized content, leading to cross-tenant data exposure and a loss of confidentiality for the affected documents.

Impact

The vulnerability allows authenticated users to access file identifiers and content belonging to other users, causing unauthorized data exposure and confidentiality breaches for uploaded files.

Remediation

Users are advised to update Gokapi to version 2.2.3, where this vulnerability has been patched.