{"id":"CVE-2026-126942","kind":"vulnerability","aliases":["CVE-2026-126942"],"related":[],"title":"Zipline: missing authorization lets users move other users' files into folders","description":"Zipline before 4.6.2 contains a missing authorization vulnerability in POST /api/user/folders that allows authenticated users to reparent other users' files by supplying their file IDs. Attackers can harvest file IDs from public folders and create a folder seeded with them, disclosing victims' file URLs and removing those files from their folder views.","summary":"Zipline, a self-hosted file sharing server, lets any logged-in user reparent other users' files by supplying their file IDs when creating a folder. An attacker can learn victims' file URLs and remove those files from the victims' folder views.","severity":"medium","cvss":5.4,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"zipline","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["file-sharing","package","self-hosted","zipline"],"not_affected_if":["managed-hosting","single-user-instance"],"how_to_check":"- Check the installed Zipline version; the sources state the flaw is in versions before `4.6.2`.\n- Confirm whether Zipline is reachable by users who hold accounts on the instance.","fix":"- Zipline: upgrade to `4.6.2` or later (per the NVD description).","status":"open","published_at":"2026-11-13T10:18:01+00:00","first_seen_at":"2026-11-13T10:47:27+00:00","triaged_at":"2026-11-13T10:56:51+00:00","updated_at":"2026-11-13T10:56:51+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-13T10:56:51Z","model":"claude-haiku-5-5","output":{"fix":"- Zipline: upgrade to `4.6.2` or later (per the NVD description).","reach":"internet","title":"Zipline: missing authorization lets users move other users' files into folders","impact":"medium","summary":"Zipline, a self-hosted file sharing server, lets any logged-in user reparent other users' files by supplying their file IDs when creating a folder. An attacker can learn victims' file URLs and remove those files from the victims' folder views.","audience":"businesses","category":"package","nicknames":[],"who_cares":["zipline","self-hosted","file-sharing"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"other users' files are exposed by URL and removed from their folders","analyst_note":"","how_to_check":"- Check the installed Zipline version; the sources state the flaw is in versions before `4.6.2`.\n- Confirm whether Zipline is reachable by users who hold accounts on the instance.","plain_action":"","product_name":"zipline","needs_analyst":false,"not_affected_if":["single-user-instance","managed-hosting"],"who_is_affected":"Teams that run a self-hosted Zipline instance with more than one user account before version 4.6.2. The attacker must have an account on that instance, and file IDs must be obtainable, for example from public folders. Single-user instances or instances on managed hosting are unlikely to be exposed.","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000726,"input_tokens":4604,"output_tokens":531,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-126942':14A,17A '-2026':13A,16A '/api/user/folders':80C '4.6.2':72C 'allow':82C 'attack':55B,95C 'authent':83C 'author':3A,76C 'contain':73C 'creat':51B,104C 'cve':12A,15A 'disclos':110C 'file':9A,20B,32B,44B,48B,59B,64B,89C,93C,98C,112C,117C 'file-shar':19B 'folder':11A,53B,68B,102C,106C,120C 'harvest':97C 'host':25B,31B 'id':49B,94C,99C 'learn':57B 'let':4A,35B 'log':38B 'logged-in':37B 'miss':2A,75C 'move':6A 'packag':22B 'post':79C 'public':101C 'remov':62B,115C 'repar':41B,86C 'seed':107C 'self':24B,30B 'self-host':23B,29B 'server':34B 'share':21B,33B 'suppli':46B,91C 'url':60B,113C 'user':5A,8A,40B,43B,84C,88C 'victim':58B,67B,111C 'view':69B,121C 'vulner':77C 'ziplin':1A,26B,27B,70C 'zipline':18A","nicknames":[],"mitigations":[],"who_affected":"Teams that run a self-hosted Zipline instance with more than one user account before version 4.6.2. The attacker must have an account on that instance, and file IDs must be obtainable, for example from public folders. Single-user instances or instances on managed hosting are unlikely to be exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["zipline"],"ptokens":["zipline"],"labels":["filesharing","medium","package","selfhosted","vendor","zipline"],"campaign_type":null,"search_a":"'-126942':14A,17A '-2026':13A,16A 'author':3A 'cve':12A,15A 'file':9A 'folder':11A 'let':4A 'miss':2A 'move':6A 'user':5A,8A 'ziplin':1A 'zipline':18A","search_b":"'attack':55B 'creat':51B 'file':20B,32B,44B,48B,59B,64B 'file-shar':19B 'folder':53B,68B 'host':25B,31B 'id':49B 'learn':57B 'let':35B 'log':38B 'logged-in':37B 'packag':22B 'remov':62B 'repar':41B 'self':24B,30B 'self-host':23B,29B 'server':34B 'share':21B,33B 'suppli':46B 'url':60B 'user':40B,43B 'victim':58B,67B 'view':69B 'ziplin':26B,27B","search_c":"'/api/user/folders':80C '4.6.2':72C 'allow':82C 'attack':95C 'authent':83C 'author':76C 'contain':73C 'creat':104C 'disclos':110C 'file':89C,93C,98C,112C,117C 'folder':102C,106C,120C 'harvest':97C 'id':94C,99C 'miss':75C 'post':79C 'public':101C 'remov':115C 'repar':86C 'seed':107C 'suppli':91C 'url':113C 'user':84C,88C 'victim':111C 'view':121C 'vulner':77C 'ziplin':70C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-06-03T02:40:33+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126942","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126942","severity":null,"published_at":"2026-11-13T10:18:01+00:00","modified_at":"2026-11-13T10:18:01+00:00","first_seen_at":"2026-11-13T10:47:27+00:00","fetched_at":"2026-11-13T10:47:27+00:00","note":null}],"documents":[{"id":145245,"url":"https://github.com/diced/zipline/security/advisories/GHSA-84c9-r2mj-p9pp","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-06-03T02:40:33+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":145246,"url":"https://www.vulncheck.com/advisories/zipline-before-4.6.2-missing-authorization-via-post-api-user-folders","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}