CVE-2026-29060: 
NixOS vulnerability analysis and mitigation

CVE-2026-29060 is a privilege escalation vulnerability in Gokapi, a self-hosted file sharing server, that allows a registered low-privileged user to generate a short-lived API key with permissions to create or modify file requests — capabilities they are not authorized to use. It affects all Gokapi versions prior to 2.2.3 and was disclosed on March 5, 2026, with a patch released the same day. The vulnerability carries a CVSS v3.1 base score of 5.0 (Moderate) (GitHub Advisory, Gokapi Advisory).

The root cause is improper access control (CWE-284): Gokapi fails to enforce permission checks when a registered user requests the generation of a short-lived API key, allowing the key to be issued with elevated permissions (file request creation/modification) regardless of the user's actual role. Exploitation requires only a valid low-privileged account on the Gokapi instance and is performed over the network with no user interaction required. The vulnerability has a changed scope, meaning the impact extends beyond the authenticated user's own resources to affect file requests across the system (GitHub Advisory, Gokapi Advisory).

A successful exploit allows a low-privileged registered user to create or modify file requests they are not authorized to manage, undermining the integrity of the file sharing system. There is no direct confidentiality or availability impact per the CVSS scoring, but unauthorized manipulation of file requests could enable data tampering or abuse of the file sharing platform. The impact is limited to instances where more than one user is registered with access to the admin/upload menu; single-admin deployments are not affected (GitHub Advisory, Gokapi Release).

No public proof-of-concept exploit code or evidence of in-the-wild exploitation has been reported. The EPSS score is approximately 0.021% (1st percentile), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires a valid registered account on the target Gokapi instance, limiting the attacker pool to authenticated users (GitHub Advisory).

1. Reconnaissance: Identify a Gokapi instance (prior to v2.2.3) with multiple registered users, where at least one user lacks admin/upload privileges.
2. Authenticate: Log in to the Gokapi instance using a low-privileged registered account that does not have permission to create or modify file requests.
3. Generate API key: Use the authenticated session to request the creation of a short-lived API key via the relevant Gokapi API or UI endpoint — the server incorrectly issues the key with elevated file request permissions due to missing access control checks.
4. Abuse elevated API key: Use the obtained API key to call Gokapi API endpoints for creating or modifying file requests, actions that the user's account role should not permit (GitHub Advisory, Gokapi Advisory).

• Logs: Gokapi application logs showing API key generation requests from non-admin user accounts, followed by API calls to file request creation or modification endpoints using those keys.
• Network: Unexpected API requests to file request management endpoints authenticated with short-lived API keys from accounts not normally associated with admin/upload activity.
• Application: Presence of newly created or modified file requests not attributable to admin users; audit trail showing API key issuance for restricted users.

The vendor has released Gokapi v2.2.3, which patches this vulnerability along with four other moderate-severity issues. All users running multi-user Gokapi instances should upgrade to v2.2.3 immediately. As an additional mitigation, v2.2.3 introduces the DISABLE_API_MENU environment variable to hide the API menu and disable new API key generation for non-admin users. Deployments with only a single admin user and no other registered users are not impacted (Gokapi Release, Gokapi Advisory).

The vulnerability was disclosed and patched by the Gokapi maintainer (Forceu) on March 5, 2026, with the release notes explicitly recommending all users update, especially those with multiple registered accounts. The release also addressed four other moderate-severity CVEs simultaneously, indicating a coordinated security release. No significant independent researcher commentary or broad media coverage has been identified beyond standard vulnerability database aggregation (Gokapi Release).