CVE-2026-11345 Improper Authentication Bypass in linqi CDN File Access
Unauthenticated attackers can bypass file access controls on the CDN endpoint, though impact is negligible as only public static assets are exposed.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-11345?
CVE-2026-11345 is a medium-severity authentication bypass vulnerability in linqi, published on 5 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An Improper Authentication vulnerability in the /api/Cdn/GetFile endpoint of linqi allows unauthenticated, remote attackers to bypass file access controls. The ValidateAnonFileAccess function incorrectly grants access if an 'AnonFile' query parameter containing exactly 256 characters is provided. While this flaw allows bypassing the intended authorization check, the actual security impact is negligible; the exposed resources are strictly limited to minified JavaScript and CSS files that contain no sensitive data and are already publicly accessible via a standard CDN.
Weakness: CWE-287
Which versions are affected by CVE-2026-11345?
How do I fix CVE-2026-11345?
No fix has been published for CVE-2026-11345 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-11345 being exploited?
There is no known exploitation of CVE-2026-11345 in the wild and no public exploit code.
Sources
Also known as GHSA-xj32-w24w-7c6q.