CVE-2026-125362

Seahub through 14.0.10 contains a weak randomness vulnerability in MultiShareLinksBatch.post() that generates batch share link passwords using Python's non-cryptographic random.choices(). Authenticated users permitted to create share links can request many generated passwords via the multi-share-links batch endpoint, recover the Mersenne Twister state, and predict other users' share link passwords.

An attacker with permission to create share links can predict other users' share link passwords, gaining unauthorized access to shared resources. This poses a serious threat to data confidentiality.

Update Seahub to a version later than 14.0.10 that uses a cryptographically secure random generator. Until then, restrict the ability to create batch links or enforce additional authentication for accessing shared resources.