Permissions check bypass in Seafile
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- High
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · None
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-639.
Summary
Seafile is an open source cloud storage system. A sync token is used in Seafile file syncing protocol to authorize access to library data. To improve performance, the token is cached in memory in seaf-server. Upon receiving a token from sync client or SeaDrive client, the server checks whether the token exist in the cache. However, if the token exists in cache, the server doesn't check whether it's associated with the specific library in the URL. This vulnerability makes it possible to use any valid sync token to access data from any **known** library. Note that the attacker has to first find out the ID of a library which it has no access to. The library ID is a random UUID, which is not possible to be guessed. There are no workarounds for this issue.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| haiwen | seafile-server | Community Edition < 8.0.8; Pro Edition < 8.0.15 | — | No fix listed | CNA |
- seafile-server Vendorhaiwen Affected Community Edition < 8.0.8; Pro Edition < 8.0.15 Fixed in — No fix listed CNA
CPE configurations NVD · 3
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:seafile:seafile_server:*:*:*:*:community:*:*:* | before 8.0.8 | Vulnerable | Seafile |
| cpe:2.3:a:seafile:seafile_server:*:*:*:*:professional:*:*:* | before 8.0.15 | Vulnerable | Seafile |
| cpe:2.3:a:seafile:seafile_server:*:*:*:*:community:*:*:* | 9.0.0 to before 9.0.2 | Vulnerable | Seafile |
- cpe:2.3:a:seafile:seafile_server:*:*:*:*:community:*:*:* Versions before 8.0.8 Vulnerable ·Seafile
- cpe:2.3:a:seafile:seafile_server:*:*:*:*:professional:*:*:* Versions before 8.0.15 Vulnerable ·Seafile
- cpe:2.3:a:seafile:seafile_server:*:*:*:*:community:*:*:* Versions 9.0.0 to before 9.0.2 Vulnerable ·Seafile
Remediation
No fixed version listed by the sources yet.
Vendor assessments
Timeline
- 2026-10-02 Threatist record created from CVE-2021-43820
References
More haiwen vulnerabilities
- TI-2026-40932 Seahub < 13.0.23 - Authentication Bypass in ShareLinkZipTaskView GET Method CVSS 4.0HIGH 8.7
Sources
- CVE-2021-43820 · CVE Program
- CVE-2021-43820 · NVD
- FIRST EPSS
- CVE-2021-43820 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences