CVE-2026-28682: 
NixOS vulnerability analysis and mitigation

CVE-2026-28682 is an information disclosure vulnerability in Gokapi, a self-hosted file sharing server, caused by improper access control in the upload status Server-Sent Events (SSE) endpoint. The /uploadStatus endpoint publishes global upload state — including file_id values — to any authenticated listener without scoping data to the requesting user. All versions of Gokapi prior to 2.2.3 are affected. The vulnerability was discovered by aisafe.io, disclosed and patched on March 5, 2026, and carries a CVSS v3.1 base score of 6.4 (Medium) (GitHub Advisory, Gokapi Advisory).

The root cause is a failure to scope Server-Sent Events (SSE) data to the authenticated requesting user, classified under CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) and CWE-284 (Improper Access Control). The /uploadStatus endpoint broadcasts a global upload state stream, meaning any authenticated user who connects to this endpoint receives upload events — including file_id values — belonging to other users' upload sessions. An attacker needs only a valid authenticated session (low privileges required) and network access to the Gokapi instance to exploit this; no special tools or complex techniques are required beyond subscribing to the SSE stream (GitHub Advisory).

Any authenticated user can observe other users' file identifiers via the SSE stream and use the leaked file_id values to retrieve unauthorized file content, resulting in cross-tenant data exposure and loss of confidentiality for uploaded documents. This is particularly impactful in multi-user Gokapi deployments where users expect their uploaded files to remain private. There is no availability impact, but both confidentiality and integrity are affected, as an attacker could access files they are not authorized to view (GitHub Advisory, Gokapi Release).

No public exploit code or in-the-wild exploitation has been reported for this vulnerability. The EPSS score is approximately 0.015% (1st percentile), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires authenticated access to the Gokapi instance, limiting the attack surface to users with valid credentials (GitHub Advisory).

1. Obtain authenticated access: Log in to a vulnerable Gokapi instance (version < 2.2.3) with any valid user account.
2. Connect to the SSE endpoint: Send an authenticated HTTP GET request to /uploadStatus to subscribe to the Server-Sent Events stream (e.g., using curl -H 'Cookie: <session>' http://<gokapi-host>/uploadStatus).
3. Capture file_id values: Monitor the SSE stream for upload events from other users; the stream will include file_id values not scoped to the attacker's session.
4. Retrieve unauthorized files: Use the captured file_id values to construct download requests and access files uploaded by other users, achieving unauthorized content retrieval (GitHub Advisory).

• Network: Unusual or repeated authenticated GET requests to the /uploadStatus endpoint from user accounts that are not actively uploading files; long-lived SSE connections from unexpected client IPs.
• Logs: Access logs showing multiple users or unexpected accounts connecting to /uploadStatus with persistent connections; download requests for file_id values not associated with the requesting user's uploads.
• Application: File access events in Gokapi logs where the accessing user does not match the file owner.

Upgrade Gokapi to version 2.2.3 or later, which patches this vulnerability along with four other moderate-severity issues and one high-severity stored XSS vulnerability. The Gokapi maintainer explicitly recommends all users update, especially instances with more than one registered user. No configuration-based workaround is available; upgrading is the only remediation (Gokapi Release, GitHub Advisory).

The vulnerability was discovered and reported by aisafe.io, credited as the finder in the GitHub Advisory. The Gokapi maintainer (Forceu) published the advisory and patch simultaneously on March 5, 2026, and issued a strong recommendation for all multi-user instance operators to update immediately. The release notes for v2.2.3 highlight this as one of five CVEs fixed in the release, with the update described as containing "important security fixes" (Gokapi Release, GitHub Advisory).