CVE-2026-29061: 
NixOS vulnerability analysis and mitigation

CVE-2026-29061 is a privilege escalation vulnerability in Gokapi, a self-hosted file sharing server, caused by incomplete API key permission revocation during user rank demotion. When an admin-rank user is demoted, their existing API keys incorrectly retain ApiPermManageFileRequests and ApiPermManageLogs permissions, allowing continued unauthorized access to privileged endpoints. All Gokapi versions prior to 2.2.3 are affected. The vulnerability was published on March 5, 2026, and carries a CVSS v3.1 base score of 5.4 (Medium) (GitHub Advisory, Gokapi Advisory).

The root cause is classified as CWE-284 (Improper Access Control): when a user's rank is demoted in Gokapi's administration interface, the demotion logic fails to revoke or update the permissions embedded in that user's existing API keys. Specifically, the ApiPermManageFileRequests and ApiPermManageLogs permission flags are not cleared from pre-existing API keys during the demotion process. An attacker (or offboarded employee) who retains a previously issued API key can continue to make authenticated API calls to upload-request management and log-viewing endpoints over the network, even after their account has been stripped of all administrative privileges. Exploitation requires the attacker to already possess a valid API key issued while they held admin rank (GitHub Advisory, Gokapi Advisory).

A demoted or offboarded user who retains a previously issued API key can create, list, and delete upload requests, as well as read application logs and system status information — capabilities that should have been revoked upon demotion. The confidentiality impact includes exposure of application logs that may contain sensitive operational data, while the integrity impact includes unauthorized manipulation of upload requests. Availability is not directly affected, and there is no evidence of lateral movement potential beyond the Gokapi application scope (GitHub Advisory).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for CVE-2026-29061. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.014% (1st percentile), indicating a very low probability of exploitation in the near term. Exploitation requires a pre-existing valid API key from when the user held admin rank, limiting the attack surface to insider threat or offboarding scenarios (GitHub Advisory).

1. Obtain API Key: The attacker must have previously held Admin rank in a Gokapi instance and possess an API key generated during that period with ApiPermManageFileRequests or ApiPermManageLogs permissions.
2. Confirm Demotion: The attacker's account is demoted by an administrator, removing their admin privileges via the Gokapi user management interface.
3. Identify Vulnerable Endpoints: Target the upload-request management API endpoints (e.g., those handling create/list/delete of upload requests) and log-viewing endpoints exposed by the Gokapi server.
4. Send Authenticated API Request: Use the retained API key in HTTP requests to the privileged endpoints (e.g., Authorization: Bearer <api_key> or equivalent Gokapi API authentication header).
5. Achieve Unauthorized Access: Because the API key still carries the unrevoked permissions, the server grants access — allowing the attacker to create or delete upload requests and read application logs containing potentially sensitive operational information (GitHub Advisory, Gokapi Advisory).

• Network: API requests to Gokapi upload-request management or log endpoints originating from accounts that have been demoted or offboarded; API calls using keys associated with non-admin users successfully accessing admin-only endpoints.
• Logs: Gokapi application logs showing successful API authentication and access to ManageFileRequests or ManageLogs endpoints by users whose rank has been changed; log entries showing upload request creation or deletion by demoted user API keys.
• Application: Unexpected upload requests appearing in the Gokapi interface not attributable to current admin users; log access events tied to API keys belonging to demoted accounts.

Upgrade Gokapi to version 2.2.3 or later, which patches this vulnerability along with four other moderate/high severity issues including a stored XSS and CSRF flaw (Gokapi v2.2.3 Release). As an immediate workaround prior to patching, administrators should manually revoke or delete all API keys belonging to any user who has been demoted or offboarded. The vendor strongly recommends updating, especially for instances with more than one registered user (Gokapi Advisory).

The vulnerability was credited to reporter "Sijisu" and finder "aisafe-bot," with remediation by the Forceu developer. The aisafe.io blog published commentary related to the discovery. The release notes for v2.2.3 emphasize the security significance of this update, recommending all multi-user Gokapi instances upgrade promptly (Gokapi v2.2.3 Release).