CVE-2025-71460: Zipline before 4.2.1 Missing Ownership Check via /api/user/files/transaction

Q: Who can exploit this issue?

Any authenticated Zipline user can exploit it, provided they know the ID of a target file. No user interaction by the file owner is required.

Q: What actions can an attacker perform?

An attacker can submit requests to the affected transaction endpoint to modify or delete files belonging to other users. The available information does not indicate confidentiality impact.

Q: Which versions should be remediated?

Zipline versions before 4.2.1 are affected. Upgrade to version 4.2.1 or later.

Published Nov 13, 2026

Updated

Zipline before 4.2.1 contains a missing authorization vulnerability in the /api/user/files/transaction endpoint that allows authenticated users to modify other users' files due to absent ownership checks. Attackers who know a target file ID can submit transaction requests to edit or delete files belonging to any user.

Affected Software

1 affected component

Zipline Zipline<4.2.1

Event History

Nov 13, 2026

CVE Published

via MITRE·09:37 AM

Data Sourced

via MITRE·09:37 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·10:17 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

Any authenticated Zipline user can exploit it, provided they know the ID of a target file. No user interaction by the file owner is required.

What actions can an attacker perform?

An attacker can submit requests to the affected transaction endpoint to modify or delete files belonging to other users. The available information does not indicate confidentiality impact.

Which versions should be remediated?