Authentication Bypass in Seahub by Haiwen

CVE-2026-56768

What is CVE-2026-56768?

Seahub versions before 13.0.23 contain a vulnerability that allows unauthenticated users to bypass necessary login checks when accessing the GET /api/v2.1/share-link-zip-task/ endpoint. By exploiting this flaw, attackers can leverage a shared folder link token to retrieve a fileserver zip token, thereby gaining unauthorized access to download entire directory trees, which poses a significant risk to data security and confidentiality.

References