CVE-2026-56768: Seahub Authentication Bypass in Share-Link ZIP Download

Technical summary

The vulnerability exists in the GET /api/v2.1/share-link-zip-task/ endpoint, which fails to validate the SHARE_LINK_LOGIN_REQUIRED configuration setting. While Seahub's share-link feature supports requiring authentication before access, this particular API endpoint bypasses that control. An attacker with a valid folder share-link token can directly call this endpoint to receive a fileserver zip token, enabling download of the entire directory tree without presenting credentials. The flaw is rooted in missing authorization logic (CWE-862: Missing Authorization) at the API layer, allowing privilege escalation from anonymous share-link holder to data exfiltrator.

Business impact

Organizations using Seahub's share-link feature to distribute files to external parties face risk of unintended data exposure. If a share was marked as requiring login—a control intended to limit access to authenticated users—attackers can circumvent that restriction and download all contents at once. This is particularly serious for shared folders containing sensitive documents, project files, or customer data. The ability to bulk-download via ZIP also increases the speed and volume of potential data theft compared to manual file-by-file access, making this an attractive vector for competitors, insiders, or opportunistic attackers.

Affected systems

Seahub versions prior to 13.0.23 are affected. The vulnerability impacts any deployment where administrators rely on the SHARE_LINK_LOGIN_REQUIRED setting to control access to shared folders. Affected organizations should verify their installed Seahub version against the official vendor advisory to confirm whether their deployment is vulnerable.

Exploitability

The attack requires network access to the Seahub instance and knowledge or possession of a valid folder share-link token. Since share-link tokens are often distributed openly (via email, chat, or public links), obtaining one is typically straightforward. Once a token is in hand, exploitation is trivial—a simple GET request to the vulnerable endpoint returns the zip token needed for download. No user interaction, special privileges, or complex attack chains are required. The CVSS score of 8.8 reflects the ease of exploitation combined with the high impact on confidentiality and integrity.

Remediation

Upgrade Seahub to version 13.0.23 or later. This patch restores the SHARE_LINK_LOGIN_REQUIRED authorization check on the /api/v2.1/share-link-zip-task/ endpoint. Administrators should verify the fix is in place by testing that share-links marked as login-required now properly reject unauthenticated ZIP download requests. Until patching is complete, consider disabling or restricting access to the share-link ZIP download feature if your instance handles sensitive data.

Patch guidance

Consult your Seahub vendor advisory for the exact steps to upgrade to 13.0.23 or later. Most Seahub deployments support in-place upgrades with database migrations. Test the patch in a non-production environment first to confirm compatibility with any custom configurations or integrations. After upgrading, verify that the SHARE_LINK_LOGIN_REQUIRED setting is now enforced by attempting to access a protected share-link ZIP task endpoint without authentication—the request should now be denied.

Detection guidance

Monitor access logs for GET requests to /api/v2.1/share-link-zip-task/ originating from unusual sources or in unusual patterns (bulk requests, multiple different share tokens in short time windows). A spike in such requests may indicate active exploitation. Additionally, review audit logs for ZIP file downloads initiated via share-links, especially those marked as requiring login. Implement alerts on 2xx responses from this endpoint to unauthenticated requests, which should never occur after patching. Network-based detection can flag requests containing share-link tokens paired with zip-task endpoint calls from non-standard clients.

Why prioritize this

This vulnerability merits immediate attention due to its high CVSS score (8.8), ease of exploitation, and direct impact on data confidentiality. The flaw allows unauthenticated access to bulk data download—a core concern for any organization using file-sharing features. The attack surface is broad (any organization with Seahub and share-links) and the prerequisites are minimal. Although not yet listed in the CISA Known Exploited Vulnerabilities catalog, the simplicity of the attack and the value of the data at risk make prompt patching essential.

Risk score, explained

The CVSS 3.1 score of 8.8 (HIGH) is driven by network-based attack vector (AV:N), low attack complexity (AC:L), and required but easily obtainable privileges (PR:L—a valid share-link token qualifies as low privilege). The impact is severe across all three categories: confidentiality (C:H) due to unauthorized data access, integrity (I:H) because an attacker could potentially modify downloaded content or metadata, and availability (A:H) if the attack is used to exfiltrate or degrade service. The scoring reflects a realistic threat scenario where share-links are common and tokens are readily available to attackers.

Frequently asked questions