CVE-2026-111332
OxiCloud 0.9.1 through 0.9.3 contains an incorrect authorization vulnerability that allows anonymous visitors to keep share access after password protection is added.
Published Oct 15, 2026 · updated Oct 15, 2026
OxiCloud 0.9.1 through 0.9.3 contains an incorrect authorization vulnerability that allows anonymous visitors to keep share access after password protection is added. Attackers holding an existing oxi_shares share-ring cookie can request content via GET /api/files/{id} to read shared files or folder contents despite the new password.
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
Oct 15, 2026 · NIST NVD
Detected
OxiCloud 0.9.1 through 0.9.3 contains an incorrect authorization vulnerability that allows anonymous visitors to keep share access after password protection is added. Attackers holding an existing oxi_shares share-ring cookie can request content via GET /api/files/{id} to read shared files or folder contents despite the new password.
Sources
- CVE.orgVulnerability recordCVE-2026-111332
Official CVE identifier
cve.org - NIST NVDVulnerability recordCVE-2026-111332
OxiCloud 0.9.1 through 0.9.3 contains an incorrect authorization vulnerability that allows anonymous visitors to keep share access after password protection is added. Attackers holding an existing oxi_shares share-ring cookie can request content via GET /api/files/{id} to read sh
nvd.nist.gov