CVE-2026-111332 Details
Description
OxiCloud 0.9.1 through 0.9.3 contains an incorrect authorization vulnerability that allows anonymous visitors to keep share access after password protection is added. Attackers holding an existing oxi_shares share-ring cookie can request content via GET /api/files/{id} to read shared files or folder contents despite the new password.
A vulnerability exists in OxiCloud versions 0.9.1 to 0.9.3, allowing anonymous users to retain access to shared files even after a password is added. This issue arises because the application does not properly enforce password requirements during the file download process. Instead, the password check is only applied when resolving share metadata. As a result, attackers with an active 'oxi_shares' share-ring cookie can bypass password protection and access shared files or folder contents through the file API.
To address this vulnerability, OxiCloud should be updated to a version that includes the necessary fixes. When adding or changing a password on a share, the application should revoke and reissue the token grant to invalidate any existing share-ring cookies. Additionally, the content authorization process should be modified to consider share passwords, ensuring that the password requirements are enforced during file downloads.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 15, 2026CISA-ADP
Assessed Oct 23, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://hackmd.io/@hieuPenguinnn/oxicloud-share-password-grant-not-revoked | CISA-ADP | ExploitTechnical Analysis |
| https://github.com/AtalayaLabs/OxiCloud | [email protected] | ProductSource CodeVendor |
| https://github.com/AtalayaLabs/OxiCloud/blob/v0.9.3/src/application/services/share_service.rs#L497-L538 | [email protected] | Source CodeVendor |
| https://github.com/AtalayaLabs/OxiCloud/blob/v0.9.3/src/infrastructure/services/share_ring.rs#L173-L195 | [email protected] | Source CodeVendor |
| https://hackmd.io/@hieuPenguinnn/oxicloud-share-password-grant-not-revoked | [email protected] | ExploitTechnical Analysis |
| https://www.vulncheck.com/advisories/oxicloud-0.9.1-through-0.9.3-incorrect-authorization-via-share-ring-cookie | [email protected] | Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-863 | Incorrect Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| AtalayaLabs OxiCloud | >= 0.9.1, <= 0.9.3 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 23, 2026 | CVE Modified | CISA-ADP |
| Oct 15, 2026 | New CVE Received | [email protected] |