Incorrect Authorization Vulnerability in OxiCloud by Atalaya Labs

CVE-2026-111332

What is CVE-2026-111332?

OxiCloud versions 0.9.1 through 0.9.3 are affected by an incorrect authorization issue that permits unauthorized users to retain access to shared files even after password protection is implemented. Specifically, users can exploit an existing 'oxi_shares' cookie to perform GET requests to the API, accessing shared file or folder content without proper authentication, potentially exposing sensitive data. To mitigate this risk, users are advised to update to the latest version and review security measures surrounding shared content management.

References