CVE-2026-126936: Zipline before 4.7.0 Race Condition in Invite and Quota Limits
Zipline before 4.7.0 contains a race condition vulnerability that allows users to bypass invitation usage limits, upload storage quotas, and shortened-URL quotas through concurrent requests. Attackers can send overlapping registration, upload, or URL creation requests that pass checks against stale state, creating extra accounts and exceeding administrator-configured resource quotas.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Ziplineto a version that resolves this vulnerability.Fixed in 4.7.0
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated user with access to registration invitations, uploads, or shortened-URL creation can exploit the race condition. Exploitation requires sending concurrent requests, and the attack complexity is rated high.
Are default deployments affected?
The available information does not state whether the affected invitation and quota limits are enabled or enforced by default. Deployments using administrator-configured invitation usage limits, storage quotas, or shortened-URL quotas are affected if they run a version before 4.7.0.
What is the impact of successful exploitation?
An attacker can create extra accounts beyond invitation limits and exceed configured upload-storage or shortened-URL quotas. This can undermine resource controls and may cause service availability issues from unbounded resource consumption.
What can be done if upgrading is not immediately possible?
The provided information identifies concurrent requests as the exploitation method, but does not specify a supported workaround. Administrators should monitor invitation consumption, storage usage, and shortened-URL creation for quota overruns while planning an upgrade to 4.7.0 or later.