CVE-2026-29061

Description

### Summary A privilege escalation vulnerability in the user rank demotion logic allows a demoted user's existing API keys to retain ApiPermManageFileRequests and ApiPermManageLogs permissions, enabling continued access to upload-request management and log viewing endpoints after the user has been stripped of all privileges. ### Impact Any user who previously held Admin rank and had API keys with ApiPermManageFileRequests or ApiPermManageLogs retains those capabilities after demotion. This allows offboarded or demoted users to: - Create, list, and delete upload requests - Read application logs and system status

Affected packages (2)

• Go/github.com/forceu/gokapifrom 0, < 2.2.3
• Go/github.com/forceu/gokapifrom 0

CVSS scores

References (4)

• ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2026-29061
• PATCHhttps://github.com/Forceu/Gokapi
• WEBhttps://github.com/Forceu/Gokapi/releases/tag/v2.2.3
• WEBhttps://github.com/Forceu/Gokapi/security/advisories/GHSA-q658-hfpg-35qc