CVE-2026-76032 pydio CVE debrief

Who should care

Defenders responsible for Pydio Cells deployments, particularly those with standard user roles, should assess exposure and verify mitigation for this vulnerability. This includes reviewing compensating controls for exposed systems while remediation is scheduled and verified, and tracking exceptions, retesting remediated assets, and closing the item only after evidence is documented.

Why it matters

CVE-2026-76032 allows authenticated users to access sensitive share-link details in Pydio Cells 5.0.0 through 5.0.2, potentially leading to unauthorized information disclosure.

• Authenticated users can access share-link details without proper authorization
• Share-link details include link hash and URL, owner's user identifier, hidden share user login, permission set, download limit and count, target users, expiry, and password-required flag
• Direct read of shared nodes from the same account is refused, but share-link details are exposed

Technical summary

Pydio Cells 5.0.0 through 5.0.2 returns share-link details to any authenticated user due to a missing authorization step in the REST handler for GET /a/share/link/{Uuid} in idm/share/rest/handler.go. The workspace UUID is not secret, because the unauthenticated public page served for a share link embeds it as START_REPOSITORY. Any account holding a standard user role can therefore submit the UUID and receive the link hash and URL, the owner's user identifier, the hidden share user login, the permission set, the download limit and count, the target users, the expiry, and the password-required flag.

Defensive priority

Defenders should prioritize verifying and mitigating this vulnerability in Pydio Cells 5.0.0 through 5.0.2, as it allows authenticated users to access share-link details without proper authorization.

Recommended defensive actions

• Verify and mitigate this vulnerability in Pydio Cells 5.0.0 through 5.0.2
• Restrict access to share-link details to authorized users only
• Monitor for potential exploitation of this vulnerability
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and source references indicate that Pydio Cells 5.0.0 through 5.0.2 has a vulnerability in the REST handler for GET /a/share/link/{Uuid} in idm/share/rest/handler.go, which returns share-link details to any authenticated user without authorization.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.