{"id":"CVE-2026-111332","summary":"OxiCloud 0.9.1 through 0.9.3 Incorrect Authorization via Share Ring Cookie","details":"OxiCloud 0.9.1 through 0.9.3 contains an incorrect authorization vulnerability that allows anonymous visitors to keep share access after password protection is added. Attackers holding an existing oxi_shares share-ring cookie can request content via GET /api/files/{id} to read shared files or folder contents despite the new password.","modified":"2026-10-21T02:55:13.140849956Z","published":"2026-10-15T21:43:35.166Z","database_specific":{"cwe_ids":["CWE-863"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/111xxx/CVE-2026-111332.json","cna_assigner":"VulnCheck"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/111xxx/CVE-2026-111332.json"},{"type":"ADVISORY","url":"https://hackmd.io/@hieuPenguinnn/oxicloud-share-password-grant-not-revoked"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111332"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/oxicloud-0.9.1-through-0.9.3-incorrect-authorization-via-share-ring-cookie"},{"type":"PACKAGE","url":"https://github.com/AtalayaLabs/OxiCloud"},{"type":"ARTICLE","url":"https://github.com/AtalayaLabs/OxiCloud/blob/v0.9.3/src/application/services/share_service.rs#L497-L538"},{"type":"ARTICLE","url":"https://github.com/AtalayaLabs/OxiCloud/blob/v0.9.3/src/infrastructure/services/share_ring.rs#L173-L195"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/atalayalabs/oxicloud","events":[{"introduced":"54f0a98d4395e8b26e6ac5575637fe234d679fe7"},{"last_affected":"fc3f27a5e995e0dd45949e9523e162a95c893b24"}],"database_specific":{"extracted_events":[{"source":"AFFECTED_FIELD","strategy":"StandardRange","range":[{"introduced":"0.9.1"},{"last_affected":"0.9.3"}]},{"source":"DESCRIPTION","range":[{"introduced":"0.9.1"},{"last_affected":"0.9.3"}]}]}}],"versions":["v0.9.3","v0.9.2","v0.9.1"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-111332.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N"}]}