Gokapi Vulnerabilities CVE-2026-30943 and CVE-2026-30955 Disclosed

Two critical vulnerabilities affecting Gokapi, a self-hosted file sharing server, were disclosed on March 13, 2026. CVE-2026-30943 involves an insufficient authorization check in the file replace API, allowing users with limited permissions to delete files belonging to others, with a CVSS score of 4.1. CVE-2026-30955 allows authenticated users to send unbounded request bodies, leading to out-of-memory (OOM) kills and service disruptions, with a CVSS score of 6.5. Both vulnerabilities were fixed in version 2.2.4. The affected versions are prior to 2.2.4. GitHub advisories have been released for both vulnerabilities. The potential impact includes unauthorized file deletions and denial of service for all users. Immediate action is required to update to the latest version to mitigate these risks.

Key Points: • CVE-2026-30943 allows unauthorized file deletions due to insufficient authorization checks. • CVE-2026-30955 can lead to service disruption through unbounded API requests. • Both vulnerabilities are patched in Gokapi version 2.2.4.