Low severity · published Oct 15, 2026
CVE-2026-111332
OxiCloud 0.9.1 through 0.9.3 Incorrect Authorization via Share Ring Cookie
3.7
CVSS
0.3%
EPSS
No
On KEV
Description
OxiCloud 0.9.1 through 0.9.3 contains an incorrect authorization vulnerability that allows anonymous visitors to keep share access after password protection is added. Attackers holding an existing oxi_shares share-ring cookie can request content via GET /api/files/{id} to read shared files or folder contents despite the new password.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 28% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OX
OxiCloud · AtalayaLabs
0.9.1 through 0.9.3 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-111332
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-111332
github.com
https://github.com/AtalayaLabs/OxiCloud
github.com
https://github.com/AtalayaLabs/OxiCloud/blob/v0.9.3/src/application/services/share_service.rs#L497-L538
github.com
https://github.com/AtalayaLabs/OxiCloud/blob/v0.9.3/src/infrastructure/services/share_ring.rs#L173-L195
hackmd.io
https://hackmd.io/@hieuPenguinnn/oxicloud-share-password-grant-not-revoked
www.vulncheck.com
https://www.vulncheck.com/advisories/oxicloud-0.9.1-through-0.9.3-incorrect-authorization-via-share-ring-cookie