CVE-2026-111332 OxiCloud 0.9.1 through 0.9.3 Incorrect Authorization via Share Ring Cookie
Attackers with existing share cookies can bypass password protection to read shared files in OxiCloud.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-111332?
CVE-2026-111332 is a medium-severity missing authorization vulnerability in AtalayaLabs OxiCloud, published on 15 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
OxiCloud 0.9.1 through 0.9.3 contains an incorrect authorization vulnerability that allows anonymous visitors to keep share access after password protection is added. Attackers holding an existing oxi_shares share-ring cookie can request content via GET /api/files/{id} to read shared files or folder contents despite the new password.
Weakness: CWE-863
Which versions are affected by CVE-2026-111332?
How do I fix CVE-2026-111332?
No fix has been published for CVE-2026-111332 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-111332 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-111332 exists.
Sources
Also known as GHSA-j8xc-5qc2-7pc3.