NIXPKGS-2026-0553

GitHub issue published on 7 Mar 2026

Permalink CVE-2026-29060

updated 11 hours ago by @mweinelt Activity log

Created automatic suggestion 1 day, 1 hour ago
@mweinelt accepted 11 hours ago
@mweinelt published on GitHub 11 hours ago

Gokapi: Privilege escalation with auth token

Gokapi is a self-hosted file sharing server with automatic expiration and encryption support. Prior to version 2.2.3, a registered user without privileges to create or modify file requests is able to create a short-lived API key that has the permission to do so. The user must be registered with Gokapi. If there are no users with access to the admin/upload menu, there is no impact. This issue has been patched in version 2.2.3.

References

https://github.com/Forceu/Gokapi/security/advisories/GHSA-m2hx-wjxc-9fp4 x_refsource_CONFIRM
https://github.com/Forceu/Gokapi/releases/tag/v2.2.3 x_refsource_MISC

Affected products

Gokapi

==< 2.2.3

Matching in nixpkgs

pkgs.gokapi

Lightweight selfhosted Firefox Send alternative without public upload

nixos-unstable 2.1.0
- nixpkgs-unstable 2.1.0
- nixos-unstable-small 2.1.0
nixos-25.11 2.1.0
- nixos-25.11-small 2.1.0
- nixpkgs-25.11-darwin 2.1.0

Package maintainers

@delliottxyz Darragh Elliott <me+git@delliott.xyz>

Nixpkgs Security Tracker

Details of issue NIXPKGS-2026-0553

References

Affected products

Matching in nixpkgs

pkgs.gokapi

Package maintainers