CVE-2026-56768

HighCVSS 8.8

Published: 25/06/2026(UTC)Updated: 25/10/2026(UTC)Translated: 15/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

0.71%

53th percentile - higher than 53% of all known CVEs

Summary

A vulnerability in Seahub before version 13.0.23 allows unauthenticated users to bypass the SHARE_LINK_LOGIN_REQUIRED enforcement on the GET /api/v2.1/share-link-zip-task/ endpoint. Attackers with a folder share-link token can obtain a fileserver zip token and download entire shared directory trees.

Risk Assessment

The organization is at risk of unauthorized access to data in shared folders, potentially leading to leakage of confidential information without required authentication.

Recommendation

Upgrade Seahub to version 13.0.23 or later immediately, which enforces authentication for this endpoint.

Other vulnerabilities in Seahub

CVE-2026-125362Low
Seahub through 14.0.10 contains a weak randomness vulnerability in MultiShareLinksBatch.post() that generates batch share link passwords using Python's non-cryptographic random.choices(). Authenticated users permitted to create share links can request many generated passwords via the multi-share-links batch endpoint, recover the Mersenne Twister state, and predict other users' share link passwords.

Original NVD description (English source)

Seahub before 13.0.23 does not enforce SHARE_LINK_LOGIN_REQUIRED on GET /api/v2.1/share-link-zip-task/, allowing unauthenticated users to bypass authentication. Attackers with a folder share-link token can call the GET endpoint to obtain a fileserver zip token and download entire shared directory trees.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS