CVE-2026-28682: Gokapi has Data Leak in Upload Status Stream

March 5, 2026 (updated March 6, 2026)

The upload status SSE implementation on /uploadStatus publishes global upload state to any authenticated listener and includes file_id values that are not scoped to the requesting user.

References

github.com/Forceu/Gokapi
github.com/Forceu/Gokapi/releases/tag/v2.2.3
github.com/Forceu/Gokapi/security/advisories/GHSA-c36c-7pc2-f2ph
github.com/advisories/GHSA-c36c-7pc2-f2ph
nvd.nist.gov/vuln/detail/CVE-2026-28682

Code Behaviors & Features

Detect and mitigate CVE-2026-28682 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →