CVE-2026-111332: OxiCloud 0.9.1 through 0.9.3 Incorrect Authorization via Share Ring Cookie
OxiCloud 0.9.1 through 0.9.3 contains an incorrect authorization vulnerability that allows anonymous visitors to keep share access after password protection is added. Attackers holding an existing oxishares share-ring cookie can request content via GET /api/files/{id} to read shared files or folder contents despite the new password.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An anonymous visitor who previously accessed a shared resource and still possesses its oxi_shares share-ring cookie can exploit it after the share owner adds password protection.
What access does exploitation provide?
The attacker can send a GET request to /api/files/{id} and read the shared file or folder contents despite the newly configured password.
Are newly password-protected shares affected?
The issue affects shares for which access was granted before password protection was added. The existing share-ring cookie remains authorized instead of being revoked.
How can I determine whether exposure is possible?
Check whether OxiCloud is running version 0.9.1 through 0.9.3 and whether password protection was added to shares that may already have been accessed by anonymous visitors.