PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-111332 AtalayaLabs CVE debrief

CVE-2026-111332 is an incorrect authorization vulnerability in OxiCloud versions 0.9.1 through 0.9.3. Attackers with an existing share-ring cookie can access shared files or folders even after a password is added. This vulnerability allows unauthorized access to shared resources, potentially leading to data breaches or further exploitation. Defenders should assess exposure and prioritize updates to prevent unauthorized access to shared resources. The vulnerability exists due to inadequate authorization checks, allowing attackers to bypass password protection using a valid share-ring cookie.

Vendor
AtalayaLabs
Product
OxiCloud
CVSS
MEDIUM 6.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-10-15
Original CVE updated
2026-10-15
Advisory published
2026-10-15
Advisory updated
2026-10-15

Who should care

Defenders and administrators of OxiCloud instances should assess exposure and prioritize updates to prevent unauthorized access to shared resources. They should review existing share-ring cookies, verify OxiCloud versions, and implement compensating controls for exposed systems. Security teams should monitor for unauthorized access and track exceptions to ensure the security of shared resources.

Why it matters

CVE-2026-111332 is a medium-severity vulnerability in OxiCloud that allows unauthorized access to shared resources. Defenders should prioritize verification, updates, and monitoring to prevent exploitation.

  • Verify and update OxiCloud instances to prevent unauthorized access
  • Revoke existing share-ring cookies to ensure security
  • Monitor for unauthorized access to shared resources

Technical summary

The vulnerability exists in OxiCloud versions 0.9.1 through 0.9.3, allowing attackers with a share-ring cookie to access shared files or folders despite new password protection. This incorrect authorization vulnerability can be exploited by attackers holding a valid share-ring cookie, potentially leading to unauthorized data access. The vulnerability is attributed to inadequate authorization checks in the affected OxiCloud versions. Defenders should prioritize verifying and updating OxiCloud instances to prevent unauthorized access to shared resources.

Defensive priority

Defenders should prioritize verifying and updating OxiCloud instances to prevent unauthorized access to shared resources.

Recommended defensive actions

  • Verify OxiCloud version and update to a fixed version if available
  • Review and revoke existing share-ring cookies
  • Monitor for unauthorized access to shared resources
  • Implement additional compensating controls for exposed systems
  • Conduct a thorough review of affected product deployments
  • Track exceptions and retest remediated assets
  • Review relevant monitoring, detection, and logs for exposed assets

Evidence notes

The vulnerability allows anonymous visitors to retain access to shared resources via a share-ring cookie even after password protection is added. This issue exists in OxiCloud versions 0.9.1 through 0.9.3. Evidence is based on the CVE record and limited source information. Defenders should verify OxiCloud instances and review existing share-ring cookies to ensure security.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-111332 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-111332

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-111332 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-111332

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • OxiCloud 0.9.1 through 0.9.3 Incorrect Authorization via Share Ring Cookie

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/111xxx/CVE-2026-111332.json

    cve_program_cvelist_v5

  • Source reference

    Unverified legacy reference

    URL: https://hackmd.io/@hieuPenguinnn/oxicloud-share-password-grant-not-revoked

    Supplemental source - third-party-advisory

  • Source reference

    Unverified legacy reference

    URL: https://github.com/AtalayaLabs/OxiCloud/blob/v0.9.3/src/application/services/share_service.rs

    Supplemental source - technical-description

  • Source reference

    Unverified legacy reference

    URL: https://github.com/AtalayaLabs/OxiCloud/blob/v0.9.3/src/infrastructure/services/share_ring.rs

    Supplemental source - technical-description

  • Source reference

    Unverified legacy reference

    URL: https://github.com/AtalayaLabs/OxiCloud

    Supplemental source - product

  • Source reference

    Unverified legacy reference

    URL: https://www.vulncheck.com/advisories/oxicloud-0.9.1-through-0.9.3-incorrect-authorization-via-share-ring-cookie

    Supplemental source - third-party-advisory

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.