VulnerabilityAnalyzed

CVE-2026-29084

Prior to version 2.2.3, the login flow accepts credential-bearing requests without CSRF protection mechanisms tied to the browser session context.

MEDIUM 4.6EPSS 0.08%

Does this matter?

Lower severity and a low EPSS score (0.08%). Track it; it rarely justifies an emergency change on its own.

Description

Gokapi is a self-hosted file sharing server with automatic expiration and encryption support. Prior to version 2.2.3, the login flow accepts credential-bearing requests without CSRF protection mechanisms tied to the browser session context. The handler parses form values directly and creates a session on successful credential validation. This issue has been patched in version 2.2.3.

CVSS 3.1: 4.6 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
EPSS: 0.08% probability · 0th percentile
CISA KEV: Not listed
Weakness: CWE-352
Affected: forceu/gokapi
Source: security-advisories@github.com

References

https://github.com/Forceu/Gokapi/releases/tag/v2.2.3Release Notes
https://github.com/Forceu/Gokapi/security/advisories/GHSA-hcff-qv74-7hr4Vendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.