ZIPLINE · CVE-2026-126948 · Package
NO FIX YET · SEE WHAT TO DO
Zipline before 4.5.0 does not check folder ownership in its PATCH and DELETE handlers for /api/user/folders/:id. A signed-in user can supply another user's folder ID to rename, publish, enable uploads on, or delete that folder.
first public Mar 21, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Any Zipline instance running a version before 4.5.0 where users have accounts on the same server. Single-user instances with no other accounts have no other users' folders to reach. unknown whether the sources name other preconditions.
Not affected if single-user, version-4.5.0-or-later
Who cares self-hosted, zipline
4.5.0 or later is not affected4.5.0 or laterZipline before 4.5.0 contains an insecure direct object reference vulnerability caused by missing ownership verification in the PATCH and DELETE handlers for /api/user/folders/:id. Authenticated attackers can supply another user's folder ID to rename it, make it public, enable uploads, or delete it.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.