CVE-2026-126948: Zipline before 4.5.0 IDOR via Folder PATCH and DELETE Endpoints
Zipline before 4.5.0 contains an insecure direct object reference vulnerability caused by missing ownership verification in the PATCH and DELETE handlers for /api/user/folders/:id. Authenticated attackers can supply another user's folder ID to rename it, make it public, enable uploads, or delete it.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Ziplineto a version that resolves this vulnerability.Fixed in 4.5.0
Event History
Frequently Asked Questions
Which deployments are affected?
Zipline versions before 4.5.0 are affected. The vulnerable functionality is exposed through the authenticated folder PATCH and DELETE API endpoints.
What does an attacker need to exploit this issue?
An attacker needs an authenticated Zipline account and the ID of another user's folder. No user interaction is required.
What can an attacker do to another user's folder?
An attacker can rename the folder, make it public, enable uploads, or delete it by submitting the other user's folder ID to the affected endpoints.
How can I determine whether exploitation may have occurred?
Review requests to /api/user/folders/:id for PATCH or DELETE operations performed by authenticated users, especially where the requesting user did not own the targeted folder. Check for unexpected folder renames, public visibility changes, upload enablement, or deletions.