CVE-2026-111332
OxiCloud 0.9.1 through 0.9.3 Incorrect Authorization via Share Ring Cookie
CVSS Score
3.7
EPSS Score
0.0%
EPSS Percentile
0th
OxiCloud 0.9.1 through 0.9.3 contains an incorrect authorization vulnerability that allows anonymous visitors to keep share access after password protection is added. Attackers holding an existing oxi_shares share-ring cookie can request content via GET /api/files/{id} to read shared files or folder contents despite the new password.
| CWE | CWE-863 |
| Vendor | atalayalabs |
| Product | oxicloud |
| Published | Oct 15, 2026 |
Stay Ahead of the Next One
Get instant alerts for atalayalabs oxicloud
Be the first to know when new low vulnerabilities affecting atalayalabs oxicloud are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
None
Availability
None
Affected Versions
AtalayaLabs / OxiCloud
0.9.1 ≤ 0.9.3
References
hackmd.io: https://hackmd.io/@hieuPenguinnn/oxicloud-share-password-grant-not-revoked github.com: https://github.com/AtalayaLabs/OxiCloud/blob/v0.9.3/src/application/services/share_service.rs#L497-L538 github.com: https://github.com/AtalayaLabs/OxiCloud/blob/v0.9.3/src/infrastructure/services/share_ring.rs#L173-L195 github.com: https://github.com/AtalayaLabs/OxiCloud vulncheck.com: https://www.vulncheck.com/advisories/oxicloud-0.9.1-through-0.9.3-incorrect-authorization-via-share-ring-cookie
Credits
hieuPenguinnn