CVE-2026-126942: Zipline before 4.6.2 Missing Authorization via POST /api/user/folders
Zipline before 4.6.2 contains a missing authorization vulnerability in POST /api/user/folders that allows authenticated users to reparent other users' files by supplying their file IDs. Attackers can harvest file IDs from public folders and create a folder seeded with them, disclosing victims' file URLs and removing those files from their folder views.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 4.6.2
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated Zipline user can exploit it. The attacker needs file IDs belonging to other users; IDs can be harvested from files in public folders.
Are private files affected?
The issue allows reparenting another user's files when their file IDs are supplied. The provided information specifically identifies public folders as a source for harvesting those IDs, but does not establish whether private-file IDs can be discovered through this vulnerability alone.
What is the impact after a file is reparented?
The attacker can create a folder containing the victim's files, disclose their file URLs, and remove those files from the victim's folder views.
What version fixes the issue?
Upgrade Zipline to version 4.6.2 or later. Versions before 4.6.2 are affected.