ZIPLINE · CVE-2026-126936 · Other
NO FIX YET · SEE WHAT TO DO
Zipline before 4.7.0 has a race condition that lets concurrent requests pass quota checks against stale state. An attacker can create extra accounts from one invitation and exceed storage and shortened-URL quotas set by an administrator.
first public Aug 16, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Teams that self-host Zipline with invitation-based registration or per-user upload and short-URL quotas are exposed. Instances without invitations or quotas, or those running 4.7.0 or later, are not affected by this flaw.
Not affected if no-invitations, no-quotas, version-4.7.0-or-later
Who cares self-hosted, zipline
4.7.04.7.0 or laterZipline before 4.7.0 contains a race condition vulnerability that allows users to bypass invitation usage limits, upload storage quotas, and shortened-URL quotas through concurrent requests. Attackers can send overlapping registration, upload, or URL creation requests that pass checks against stale state, creating extra accounts and exceeding administrator-configured resource quotas.
This page as .md · .json · CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.