6.4

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-28682

CVE-2026-28682: Gokapi: Data Leak in Upload Status Stream

Gokapi is a self-hosted file sharing server with automatic expiration and encryption support. Prior to version 2.2.3, the upload status SSE implementation on /uploadStatus publishes global upload state to any authenticated listener and includes file_id values that are not scoped to the requesting user. This issue has been patched in version 2.2.3.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-28682

CVE-2026-28682:

6.4

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/forceu/gokapi	go	< 2.2.3	2.2.3

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists in the Server-Sent Events (SSE) implementation for upload status, located at the /uploadStatus endpoint. The root cause is a lack of proper access control. The system was broadcasting the upload status of all users to any authenticated user who subscribed to the status stream.

The analysis of the patch between vulnerable version 2.2.2 and patched version 2.2.3 reveals the exact flaw. The primary vulnerable function is sse.GetStatusSSE. In its insecure state, it called pstatusdb.GetAll(), which fetched every single upload status object from the database, regardless of the user who owned it. These statuses, containing sensitive file_ids, were then passed to sse.publishMessage.

The sse.publishMessage function, in turn, would iterate through all active SSE listeners and push the status update to them, failing to check if the user associated with the listener was the actual owner of the file being uploaded. This created a data leak where any authenticated user could monitor the file uploads of all other users on the platform.

The patch rectifies this by introducing user-ID-based filtering at multiple levels:

A UserId field is added to the UploadStatus model.
The pstatusdb.GetAll() function is replaced with pstatusdb.GetAllForUser(userId), which only fetches statuses belonging to the specified user.
The sse.publishMessage function is modified to accept a userId and only sends the event to the listener associated with that user.
The sse.GetStatusSSE handler is updated to use these new, secure functions, ensuring that a user connecting to the stream only receives status updates for their own uploads.

Vulnerable functions

sse.GetStatusSSE

internal/webserver/sse/Sse.go

This function is the HTTP handler for the `/uploadStatus` Server-Sent Events (SSE) endpoint. The vulnerable version retrieved all upload statuses from all users using `pstatusdb.GetAll()` and then broadcasted them via `PublishNewStatus` to any authenticated user connected to the endpoint. This allowed an attacker to obtain `file_id` values for files belonging to other users.

sse.publishMessage

internal/webserver/sse/Sse.go

This function is responsible for sending events to connected SSE listeners. The vulnerable version broadcasted every message to every listener, without checking if the listener was authorized to receive it. The patch introduced a `userId` check to ensure messages are only sent to the intended recipient's channel.

pstatusdb.GetAll

internal/storage/processingstatus/pstatusdb/PStatusDb.go

This function was the source of the data leak. It returned a list of all upload statuses across all users, without any access control. It was called by the `GetStatusSSE` handler, which then broadcasted the sensitive information. The function was made private to its package and replaced by `GetAllForUser` to fix the issue.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.