Missing Authorization Vulnerability in XBackBone by SergiX44
CVE-2026-110230

5.3MEDIUM

Key Information:

Vendor

Sergix44

Status
Xbackbone
Vendor
CVE Published:
13 October 2026

What is CVE-2026-110230?

XBackBone versions leading up to 3.8.2 include a vulnerability where authenticated users can exploit the system by modifying other users' upload share codes. This flaw exists on the POST /upload/{id}/vanity endpoint, enabling attackers to supply sequential upload IDs to the MediaController::createVanity() function. Consequently, this allows them to disrupt existing share links and seize control of the associated codes for their uploads. Prompt updates and security best practices are essential to mitigate this risk.

Affected Version(s)

XBackBone 0 <= 3.8.2

References

https://github.com/sergix44/xbackbone/pull/671
patchissue-tracking
https://github.com/sergix44/xbackbone/commit/5e91a2a9859d...
patch
https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/ByAj-Xoifl
third-party-advisory

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

hieuPenguinnn
AARUSHGAUR
.