Gokapi is a self-hosted file sharing server with automatic expiration and encryption support. Prior to 2.2.4, An insufficient authorization check in the file replace API allows a user with only list visibility permission (UserPermListOtherUploads) to delete another user's file by abusing the deleteNewFile flag, bypassing the requirement for UserPermDeleteOtherUploads. This vulnerability is fixed in 2.2.4.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:L/A:N
GitHub Advisories released a security advisory .
A CVSS base score of 4.1 has been assigned.
Feedly found the first article mentioning CVE-2026-30943 . See article
NVD published the first details for CVE-2026-30943
[GHSA-j6jp-78w8-34x6] Gokapi vulnerable to Privilege Escalation in File Replace
CVE-2026-30943 | Forceu Gokapi up to 2.2.3 File Replace API authorization
CVE-2026-30943: CWE-863: Incorrect Authorization in Forceu Gokapi
Collect, analyze, and vulnerability reports faster using AI
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
