Missing authorization in XBackBone lets users change other users' share codes
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- None · Low · Low
- Fix status
- No fix listed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-862.
Summary
XBackBone through 3.8.2 contains a missing authorization flaw (CWE-862) in the POST /upload/{id}/vanity route. An authenticated user can change the share codes of other users' uploads, which breaks existing share links and lets the attacker take over the freed codes with their own uploads.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
Description from the CNA
XBackBone through 3.8.2 contains a missing authorization vulnerability that allows authenticated users to change other users' upload share codes via the POST /upload/{id}/vanity route. Attackers can supply sequential upload ids to MediaController::createVanity() to break existing share links and hijack the freed codes with their own uploads.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
The sources list no fixed version for XBackBone.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
Timeline
- 2026-10-13 Threatist record created from CVE-2026-110230
- 2026-10-13 Alias added: GHSA-qxxw-p862-7pgx
References
Patch 2
Sources
- CVE-2026-110230 · CVE Program
- CVE-2026-110230 · NVD
- FIRST EPSS
- GHSA-qxxw-p862-7pgx · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences