CVE-2026-30943: Gokapi vulnerable to Privilege Escalation in File Replace

March 13, 2026 (updated March 24, 2026)

An insufficient authorization check in the file replace API allows a user with only list visibility permission (UserPermListOtherUploads) to delete another user’s file by abusing the deleteNewFile flag, bypassing the requirement for UserPermDeleteOtherUploads.

References

github.com/Forceu/Gokapi
github.com/Forceu/Gokapi/releases/tag/v2.2.4
github.com/Forceu/Gokapi/security/advisories/GHSA-j6jp-78w8-34x6
github.com/advisories/GHSA-j6jp-78w8-34x6
nvd.nist.gov/vuln/detail/CVE-2026-30943
pkg.go.dev/vuln/GO-2026-4696

Code Behaviors & Features

Detect and mitigate CVE-2026-30943 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →