CVE-2026-56768 haiwen CVE debrief

Who should care

Organizations using Seahub, especially those with publicly accessible share links, should be aware of this vulnerability. Attackers can exploit this issue to download sensitive files without authentication, potentially leading to data breaches. Users of Seahub versions prior to 13.0.23 are particularly at risk.

Technical summary

The vulnerability is caused by the lack of authentication enforcement on the GET /api/v2.1/share-link-zip-task/ endpoint in Seahub before version 13.0.23. Specifically, the SHARE_LINK_LOGIN_REQUIRED setting is not applied to this endpoint, allowing unauthenticated access. An attacker can exploit this by providing a valid folder share-link token to obtain a fileserver zip token, which can then be used to download entire directory trees shared via the platform.

Defensive priority

High priority should be given to updating Seahub to version 13.0.23 or later. In the meantime, defenders should review their current configurations and ensure that share links are not publicly accessible or restrict access to sensitive directories.

Recommended defensive actions

• Update Seahub to version 13.0.23 or later to enforce SHARE_LINK_LOGIN_REQUIRED on the affected endpoint.
• Review and restrict access to share links, especially those pointing to sensitive directories.
• Monitor for suspicious activity related to share link usage and zip task views.
• Implement additional authentication mechanisms for accessing shared directories and files.
• Conduct a thorough inventory of Seahub instances and their configurations to identify potential exposure.

Evidence notes

The CVE record and NVD details were obtained from official sources. The vulnerability was reported by an unknown source, but references include commits and issues from the Seahub GitHub repository. The accuracy of the CVSS score and severity classification should be verified with the official CVE and NVD records.

Official resources