CVE-2026-126936

MEDIUM 5.9

Zipline before 4.7.0 Race Condition in Invite and Quota Limits

CVSS Score

5.9

EPSS Score

0.0%

EPSS Percentile

0th

Zipline before 4.7.0 contains a race condition vulnerability that allows users to bypass invitation usage limits, upload storage quotas, and shortened-URL quotas through concurrent requests. Attackers can send overlapping registration, upload, or URL creation requests that pass checks against stale state, creating extra accounts and exceeding administrator-configured resource quotas.

CWE	CWE-367
Vendor	diced
Product	zipline
Published	Nov 13, 2026

Stay Ahead of the Next One

Get instant alerts for diced zipline

Be the first to know when new medium vulnerabilities affecting diced zipline are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

High

Affected Versions

diced / zipline

0 < 4.7.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/diced/zipline/security/advisories/GHSA-wq7g-g9f8-8q2p vulncheck.com: https://www.vulncheck.com/advisories/zipline-before-4.7.0-race-condition-in-invite-and-quota-limits

Credits

🔍 tonghuaroot