CVE-2026-128970: Missing membership acceptance check permits group share-right deletion by invitees in Psono Server
Psono Server Community Edition versions 1.12.6 through 7.5.0 and Psono Server Enterprise Edition before 7.5.1 do not require accepted group membership when authorizing deletion of group share-rights. The DELETE /share/right/ endpoint checks for a membership matching the target group, the authenticated user, and shareadmin=True, but omits accepted=True. An authenticated remote attacker who has been invited to a group with share-admin privileges, and who knows a group share-right UUID, can therefore delete that group's share-right record without accepting the invitation or after declining it. Pending invitations have accepted=None, while declined invitations retain accepted=False and the shareadmin flag. Deletion revokes the group's access to the affected share and its contained secrets for all accepted group members, without deleting the underlying data or disclosing secret contents. The issue was fixed in version 7.5.1 of both editions, released on 2026-10-13.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Psono Serverto a version that resolves this vulnerability.Fixed in 7.5.1
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated remote user must have been invited to the target group with share-admin privileges. The invitation may still be pending or may have been declined; accepted membership is not required.
What information does an attacker need to delete a share-right?
The attacker needs the UUID of a group share-right record for the group to which they were invited as a share administrator. The vulnerable DELETE /share/right/ endpoint uses the matching membership and share_admin flag but does not verify acceptance.
What is the operational impact of a successful deletion?
Deleting the share-right revokes the group's access to the affected share and its contained secrets for all accepted group members. It does not delete the underlying data or disclose secret contents.
Which deployments need to be updated?
Community Edition versions 1.12.6 through 7.5.0 and Enterprise Edition versions before 7.5.1 are affected. The issue is fixed in version 7.5.1 for both editions.
How can exposure be reduced before updating?
Remove or avoid granting share-admin privileges to pending or declined group invitations, since those records can retain the share_admin flag. Review invited users and group share-rights for memberships that are not accepted.