CVE-2026-110230: XBackBone through 3.8.2 Missing Authorization via Upload Vanity Endpoint
XBackBone through 3.8.2 contains a missing authorization vulnerability that allows authenticated users to change other users' upload share codes via the POST /upload/{id}/vanity route. Attackers can supply sequential upload ids to MediaController::createVanity() to break existing share links and hijack the freed codes with their own uploads.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated XBackBone user can exploit it. The attacker needs to submit requests to the upload vanity endpoint and can target uploads by supplying sequential upload IDs.
What is the impact on existing shared uploads?
An attacker can change another user's upload share code, breaking that upload's existing share link. The attacker can then assign the freed code to one of their own uploads, effectively hijacking the old link destination.
Is an unauthenticated or user-interaction-based attack possible?
The provided information identifies authentication as required. It does not indicate that victim interaction is required.
How can administrators identify potential exploitation?
Review POST requests to /upload/{id}/vanity for changes made by users who do not own the referenced upload. Unexpected share-code changes, particularly involving sequential upload IDs or codes later assigned to different uploads, are relevant indicators.