CVE-2026-11345

UNKNOWN 0.0

Improper Authentication Bypass in linqi CDN File Access

CVSS Score

0.0

EPSS Score

0.1%

EPSS Percentile

33th

An Improper Authentication vulnerability in the /api/Cdn/GetFile endpoint of linqi allows unauthenticated, remote attackers to bypass file access controls. The ValidateAnonFileAccess function incorrectly grants access if an 'AnonFile' query parameter containing exactly 256 characters is provided. While this flaw allows bypassing the intended authorization check, the actual security impact is negligible; the exposed resources are strictly limited to minified JavaScript and CSS files that contain no sensitive data and are already publicly accessible via a standard CDN.

CWE	CWE-287
Vendor	linqi gmbh
Product	linqi
Published	Jun 5, 2026
Last Updated	Jun 5, 2026

Stay Ahead of the Next One

Get instant alerts for linqi gmbh linqi

Be the first to know when new unknown vulnerabilities affecting linqi gmbh linqi are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

linqi GmbH / linqi

0 < 1.4.8.6

References

NVD ↗ CVE.org ↗ EPSS Data ↗

linqi.help: https://linqi.help/en/reference/security/security-advisories/#security-advisory-improper-authentication-bypass-in-cdn-file-access-in-linqi

Credits

Ianis BERNARD from NATO Cyber Security Centre (NCSC)