Read the docs
TI-2026-09793 Aliases CVE-2026-11345GHSA-xj32-w24w-7c6q

Improper Authentication Bypass in linqi CDN File Access

Priority LOW 37CWE-287Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-287.

Summary

An Improper Authentication vulnerability in the /api/Cdn/GetFile endpoint of linqi allows unauthenticated, remote attackers to bypass file access controls. The ValidateAnonFileAccess function incorrectly grants access if an 'AnonFile' query parameter containing exactly 256 characters is provided. While this flaw allows bypassing the intended authorization check, the actual security impact is negligible; the exposed resources are strictly limited to minified JavaScript and CSS files that contain no sensitive data and are already publicly accessible via a standard CDN.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00414 36th percentileScored 2026-11-07
Fix Fixed linqi (linqi GmbH): 1.4.8.6

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
linqi GmbHlinqibefore 1.4.8.61.4.8.6Patch availableCNA
  • linqi Vendorlinqi GmbH Affected before 1.4.8.6 Fixed in 1.4.8.6 Patch available CNA

Remediation

  • Fix · CNA linqi (linqi GmbH) Fixed in 1.4.8.6

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Advisory ·

    linqi — linqi.help/en/reference/security/security-advisories

    4 records Highest priority Priority LOW 4 LOW

    Other records, highest priority first

    • TI-2026-09795 Hardcoded Cryptographic Keys and Weak IV Generation in linqiPriority LOW 37
    • TI-2026-09814 IDOR in Comment API Allows Cross-Process Comment Read and WritePriority LOW 31
    • TI-2026-09794 Server-Side Request Forgery (SSRF) allowing Internal Network Probing in linqiPriority LOW 23
    Show all 4 records → Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-11345
  2. 2026-10-03 Alias added: GHSA-xj32-w24w-7c6q

References

Advisory 1

  • TI-2024-22349 An issue was discovered in linqi before 1.4.0.1 on Windows. CVSS 3.1CRITICAL 9.8
  • TI-2024-22344 An issue was discovered in linqi before 1.4.0.1 on Windows. CVSS 3.1CRITICAL 9.8
  • TI-2024-22346 An issue was discovered in linqi before 1.4.0.1 on Windows. CVSS 3.1HIGH 7.5
  • TI-2026-09795 Hardcoded Cryptographic Keys and Weak IV Generation in linqi CVSS 4.0HIGH 8.5
  • TI-2026-09814 IDOR in Comment API Allows Cross-Process Comment Read and Write CVSS 4.0HIGH 7.1
  • TI-2024-22345 An issue was discovered in linqi before 1.4.0.1 on Windows. CVSS 3.1MEDIUM 5.9
See all 9 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences