TI-2026-40932 Aliases CVE-2026-56768 GHSA-w52g-25r7-3c46

Seahub < 13.0.23 - Authentication Bypass in ShareLinkZipTaskView GET Method

MEDIUM 41CWE-862Published 2026-06-25 · Updated 2026-07-14

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: Security bypass
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-862.

Summary

Seahub before 13.0.23 does not enforce SHARE_LINK_LOGIN_REQUIRED on GET /api/v2.1/share-link-zip-task/, allowing unauthenticated users to bypass authentication. Attackers with a folder share-link token can call the GET endpoint to obtain a fileserver zip token and download entire shared directory trees.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00712 53rd percentileScored 2026-11-07

Fix Fixed seahub (haiwen): 13.0.23

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
haiwen	seahub	before 13.0.23	13.0.23	Patch available	CNA

seahub Vendorhaiwen Affected before 13.0.23 Fixed in 13.0.23 Patch available CNA

Remediation

Fix · CNA seahub (haiwen) Fixed in 13.0.23

Timeline

2026-10-02 Threatist record created from CVE-2026-56768
2026-10-03 Alias added: GHSA-w52g-25r7-3c46

References

Patch 2

Other 2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences