5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-29060

CVE-2026-29060: Gokapi: Privilege escalation with auth token

Gokapi is a self-hosted file sharing server with automatic expiration and encryption support. Prior to version 2.2.3, a registered user without privileges to create or modify file requests is able to create a short-lived API key that has the permission to do so. The user must be registered with Gokapi. If there are no users with access to the admin/upload menu, there is no impact. This issue has been patched in version 2.2.3.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-29060

CVE-2026-29060:

5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/forceu/gokapi	go	< 2.2.3	2.2.3

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability analysis identified a privilege escalation flaw within the Gokapi application, specifically in the creation of API keys. The root cause was an improper access control vulnerability in the api.apiCreateApiKey function. The investigation began by examining the provided security advisory, which indicated that the vulnerability was patched in version 2.2.3. By comparing the git tags for versions 2.2.2 and 2.2.3, I identified the specific commit that contained the security fix. The commit message, "Added DISABLE_API_MENU env to hide API menu and disable generation of new API keys for non-admin users," directly pointed to the nature of the patch.

A detailed review of the code changes in this commit revealed that the api.apiCreateApiKey function in internal/webserver/api/Api.go was modified to include an authorization check. Previously, this function did not verify if the user making the request had the necessary permissions to create an API key. This allowed any authenticated user, regardless of their privilege level, to access this function and generate a new key. The exploit scenario involves a low-privileged user creating a key that could then be used to perform actions reserved for more privileged accounts, such as creating file requests. The patch introduces a check that prevents non-admin users from creating API keys when a new environment variable, GOKAPI_DISABLE_API_MENU, is set. This effectively closes the privilege escalation vector. Therefore, the api.apiCreateApiKey function is the primary vulnerable function that would appear in a runtime profile during exploitation.

Vulnerable functions

api.apiCreateApiKey

internal/webserver/api/Api.go

This function is responsible for creating API keys. Before the patch, it lacked proper authorization checks, allowing any authenticated user to call this endpoint and generate an API key. A non-privileged user could create an API key that grants permissions to create or modify file requests, leading to privilege escalation. The patch mitigates this by adding a check to ensure that only admin users can create API keys if the feature is disabled for non-admins in the configuration.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.