{"id":"CVE-2026-117469","kind":"vulnerability","aliases":["CVE-2026-117469"],"related":[],"title":"Psono Server: read-only users can append data to owners' files","description":"Psono Server (CE & EE) versions 1.0.0 through 7.2.3 did not enforce the direction of file-transfer credentials on file-repository operations. An authenticated remote attacker with read-only access to a file could present a download transfer to the upload endpoint, obtain a signed upload URL for an attacker-selected object key, and append a chunk to the owner's file. Exploitation could upload or overwrite repository objects and consume storage, subject to transfer size, chunk-count, and lifetime limits.","summary":"Psono Server 1.0.0 through 7.2.3 does not check whether a file-transfer credential is meant for download or upload. An authenticated user with read-only access to a file can use a download credential at the upload endpoint, letting them write or overwrite repository objects and use up storage.","severity":"medium","cvss":5.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["file-sharing","package","password-manager","psono","self-hosted"],"not_affected_if":["auth-required"],"how_to_check":"- unknown","fix":"- Upgrade Psono Server to a version later than `7.2.3` once a fixed release is confirmed (sources do not name one).","status":"open","published_at":"2026-10-27T06:17:24+00:00","first_seen_at":"2026-10-27T06:25:21+00:00","triaged_at":"2026-10-27T06:26:23+00:00","updated_at":"2026-10-27T06:26:23+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-27T06:26:23Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Psono Server to a version later than `7.2.3` once a fixed release is confirmed (sources do not name one).","reach":"internet","title":"Psono Server: read-only users can append data to owners' files","impact":"medium","summary":"Psono Server 1.0.0 through 7.2.3 does not check whether a file-transfer credential is meant for download or upload. An authenticated user with read-only access to a file can use a download credential at the upload endpoint, letting them write or overwrite repository objects and use up storage.","category":"package","nicknames":[],"who_cares":["psono","self-hosted","password-manager","file-sharing"],"confidence":0.6,"needs_auth":"yes","worst_case":"Authenticated users overwrite or add objects in owners' file repositories.","analyst_note":"Find the fixed Psono Server release and the advisory or commit for CVE-2026-117469 at https://nvd.nist.gov/vuln/detail/CVE-2026-117469 to fill in the fix version and check.","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":["auth-required"],"who_is_affected":"Teams that self-host Psono Server (Community or Enterprise) in the affected range 1.0.0 through 7.2.3 and let users share files through it. Exposure requires an account with read-only access to a shared file. Installations outside this version range, or without file-repository sharing in use, are unlikely to be affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000606,"input_tokens":3395,"output_tokens":533,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-117469':15A,18A '-2026':14A,17A '1.0.0':32B,86C '7.2.3':34B,88C 'access':57B,112C 'append':8A,138C 'attack':107C,133C 'attacker-select':132C 'authent':51B,105C 'ce':83C 'check':37B 'chunk':140C,161C 'chunk-count':160C 'consum':154C 'could':116C,147C 'count':162C 'credenti':43B,65B,98C 'cve':13A,16A 'data':9A 'direct':93C 'download':47B,64B,119C 'ee':84C 'endpoint':69B,124C 'enforc':91C 'exploit':146C 'file':12A,20B,41B,60B,96C,101C,115C,145C 'file-repositori':100C 'file-shar':19B 'file-transf':40B,95C 'host':29B 'key':136C 'let':70B 'lifetim':164C 'limit':165C 'manag':25B 'meant':45B 'object':76B,135C,152C 'obtain':125C 'oper':103C 'overwrit':74B,150C 'owner':11A,143C 'packag':22B 'password':24B 'password-manag':23B 'present':117C 'psono':1A,26B,30B,81C 'read':4A,55B,110C 'read-on':3A,54B,109C 'remot':106C 'repositori':75B,102C,151C 'select':134C 'self':28B 'self-host':27B 'server':2A,31B,82C 'share':21B 'sign':127C 'size':159C 'storag':80B,155C 'subject':156C 'transfer':42B,97C,120C,158C 'upload':49B,68B,123C,128C,148C 'url':129C 'use':62B,78B 'user':6A,52B 'version':85C 'whether':38B 'write':72B","nicknames":[],"mitigations":[],"who_affected":"Teams that self-host Psono Server (Community or Enterprise) in the affected range 1.0.0 through 7.2.3 and let users share files through it. Exposure requires an account with read-only access to a shared file. Installations outside this version range, or without file-repository sharing in use, are unlikely to be affected.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T06:17:24+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L","cvss_by":"fdf66990-8419-4c8c-8848-ec15d75773b4","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-117469","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117469","severity":null,"published_at":"2026-10-27T06:17:24+00:00","modified_at":"2026-10-27T06:17:24+00:00","first_seen_at":"2026-10-27T06:25:21+00:00","fetched_at":"2026-10-27T06:25:21+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}