CVE-2026-111332 in OxiCloud
Summary
by MITRE • 10/16/2026
OxiCloud 0.9.1 through 0.9.3 contains an incorrect authorization vulnerability that allows anonymous visitors to keep share access after password protection is added. Attackers holding an existing oxi_shares share-ring cookie can request content via GET /api/files/{id} to read shared files or folder contents despite the new password.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/16/2026
The vulnerability identified in OxiCloud versions 0.9.1 through 0.9.3 represents a critical failure in access control logic, specifically categorized under CWE-285 Improper Authorization. This flaw allows authenticated users who have previously established trust with the system to bypass newly implemented security controls designed to restrict data exposure. The core issue lies in how the application handles session validation and permission checks when a shared resource transitions from an open state to a password-protected state. Instead of invalidating existing sessions or re-evaluating permissions against the new authentication requirement, the server continues to honor requests based on legacy credentials that were valid prior to the security update.
The technical mechanism of this exploitation involves the manipulation of session cookies associated with shared resources. An attacker who possesses a valid oxi_shares share-ring cookie can interact directly with the application's API endpoint located at GET /api/files/{id}. Under normal circumstances, accessing this endpoint should require verification that the requester has permission to view the specific file or folder contents. However, due to the authorization flaw, the server fails to cross-reference the current password protection status of the resource against the permissions granted by the existing cookie. Consequently, the application serves the requested data without prompting for the newly set password, effectively rendering the protective measure useless for any user who already had access before it was enabled.
From an operational perspective, this vulnerability poses a significant risk to data confidentiality and integrity. It enables unauthorized disclosure of sensitive information that administrators or owners intended to restrict through password protection. This scenario is particularly dangerous in environments where shared files contain proprietary business data, personal identifiable information, or other confidential assets. The ability for anonymous visitors—or more accurately, previously authorized users—to retain access undermines the principle of least privilege and creates a persistent security gap that persists until existing sessions are explicitly terminated or the application logic is patched to enforce real-time permission checks.
This behavior aligns with MITRE ATT&CK technique T1078 Valid Accounts, as it involves the use of legitimate credentials to maintain unauthorized access to resources after their intended permissions have been altered. It also reflects aspects of CWE-640 Weak Password Recovery Mechanisms for Forgotten Passwords in a broader sense, although more accurately described as a failure in session management and state transition handling within web applications. The vulnerability highlights the importance of ensuring that changes to resource security settings trigger immediate re-authentication or session invalidation processes to prevent stale permissions from being exploited.
To mitigate this risk, administrators should immediately upgrade OxiCloud to version 0.9.4 or later where these authorization checks have been corrected. In the interim, it is advisable to manually invalidate all existing share-ring cookies for any resources that are subsequently password-protected. Implementing strict session management policies that require re-authentication upon changes to resource permissions can also help prevent similar issues in other applications. Regular security audits and penetration testing focusing on access control logic transitions are recommended to identify and remediate such flaws before they can be exploited by malicious actors seeking unauthorized data access.