Search

Find a vulnerability

Search criteria

    2 vulnerabilities found for OxiCloud by AtalayaLabs

    CVE-2026-111332 (GCVE-0-2026-111332)

    Vulnerability from nvd – Published: 2026-10-15 21:43 – Updated: 2026-10-15 21:43
    VLAI
    Title
    OxiCloud 0.9.1 through 0.9.3 Incorrect Authorization via Share Ring Cookie
    Summary
    OxiCloud 0.9.1 through 0.9.3 contains an incorrect authorization vulnerability that allows anonymous visitors to keep share access after password protection is added. Attackers holding an existing oxi_shares share-ring cookie can request content via GET /api/files/{id} to read shared files or folder contents despite the new password.
    Severity
    6.3 (Medium)
    CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
    3.7 (Low)
    CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
    CWE
    • CWE-863 - Incorrect Authorization
    Assigner
    VulnCheck CNA under the mitre root
    CNA scorecard B 84/100 over 6474 records in the last 180 days details
    References
    Impacted products
    Vendor Product Version
    AtalayaLabs OxiCloud Affected: 0.9.1 , ≤ 0.9.3 (semver)
    		Create a notification for this product.
    Date Public
    2026-10-15 00:00
    Credits
    hieuPenguinnn
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:github/AtalayaLabs/OxiCloud",
          "product": "OxiCloud",
          "repo": "https://github.com/AtalayaLabs/OxiCloud",
          "vendor": "AtalayaLabs",
          "versions": [
            {
              "lessThanOrEqual": "0.9.3",
              "status": "affected",
              "version": "0.9.1",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "hieuPenguinnn"
        }
      ],
      "datePublic": "2026-10-15T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "OxiCloud 0.9.1 through 0.9.3 contains an incorrect authorization vulnerability that allows anonymous visitors to keep share access after password protection is added. Attackers holding an existing oxi_shares share-ring cookie can request content via GET /api/files/{id} to read shared files or folder contents despite the new password."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-863",
              "description": "Incorrect Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-15T21:43:35.166Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://hackmd.io/@hieuPenguinnn/oxicloud-share-password-grant-not-revoked"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/AtalayaLabs/OxiCloud/blob/v0.9.3/src/application/services/share_service.rs#L497-L538"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/AtalayaLabs/OxiCloud/blob/v0.9.3/src/infrastructure/services/share_ring.rs#L173-L195"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/AtalayaLabs/OxiCloud"
        },
        {
          "name": "VulnCheck Advisory: OxiCloud 0.9.1 through 0.9.3 Incorrect Authorization via Share Ring Cookie",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/oxicloud-0.9.1-through-0.9.3-incorrect-authorization-via-share-ring-cookie"
        }
      ],
      "title": "OxiCloud 0.9.1 through 0.9.3 Incorrect Authorization via Share Ring Cookie",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-111332",
    "datePublished": "2026-10-15T21:43:35.166Z",
    "dateReserved": "2026-10-15T20:43:59.141Z",
    "dateUpdated": "2026-10-15T21:43:35.166Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-111332 (GCVE-0-2026-111332)

    Vulnerability from cvelistv5 – Published: 2026-10-15 21:43 – Updated: 2026-10-15 21:43
    VLAI
    Title
    OxiCloud 0.9.1 through 0.9.3 Incorrect Authorization via Share Ring Cookie
    Summary
    OxiCloud 0.9.1 through 0.9.3 contains an incorrect authorization vulnerability that allows anonymous visitors to keep share access after password protection is added. Attackers holding an existing oxi_shares share-ring cookie can request content via GET /api/files/{id} to read shared files or folder contents despite the new password.
    Severity
    6.3 (Medium)
    CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
    3.7 (Low)
    CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
    CWE
    • CWE-863 - Incorrect Authorization
    Assigner
    VulnCheck CNA under the mitre root
    CNA scorecard B 84/100 over 6474 records in the last 180 days details
    References
    Impacted products
    Vendor Product Version
    AtalayaLabs OxiCloud Affected: 0.9.1 , ≤ 0.9.3 (semver)
    		Create a notification for this product.
    Date Public
    2026-10-15 00:00
    Credits
    hieuPenguinnn
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:github/AtalayaLabs/OxiCloud",
          "product": "OxiCloud",
          "repo": "https://github.com/AtalayaLabs/OxiCloud",
          "vendor": "AtalayaLabs",
          "versions": [
            {
              "lessThanOrEqual": "0.9.3",
              "status": "affected",
              "version": "0.9.1",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "hieuPenguinnn"
        }
      ],
      "datePublic": "2026-10-15T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "OxiCloud 0.9.1 through 0.9.3 contains an incorrect authorization vulnerability that allows anonymous visitors to keep share access after password protection is added. Attackers holding an existing oxi_shares share-ring cookie can request content via GET /api/files/{id} to read shared files or folder contents despite the new password."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-863",
              "description": "Incorrect Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-15T21:43:35.166Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://hackmd.io/@hieuPenguinnn/oxicloud-share-password-grant-not-revoked"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/AtalayaLabs/OxiCloud/blob/v0.9.3/src/application/services/share_service.rs#L497-L538"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/AtalayaLabs/OxiCloud/blob/v0.9.3/src/infrastructure/services/share_ring.rs#L173-L195"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/AtalayaLabs/OxiCloud"
        },
        {
          "name": "VulnCheck Advisory: OxiCloud 0.9.1 through 0.9.3 Incorrect Authorization via Share Ring Cookie",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/oxicloud-0.9.1-through-0.9.3-incorrect-authorization-via-share-ring-cookie"
        }
      ],
      "title": "OxiCloud 0.9.1 through 0.9.3 Incorrect Authorization via Share Ring Cookie",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-111332",
    "datePublished": "2026-10-15T21:43:35.166Z",
    "dateReserved": "2026-10-15T20:43:59.141Z",
    "dateUpdated": "2026-10-15T21:43:35.166Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}