CVE-2026-30943

CVE-2026-30943 is an insufficient authorization vulnerability affecting Gokapi, a self-hosted file sharing server, in versions prior to 2.2.4. This flaw allows an authenticated user with limited permissions (list visibility) to delete another user's files by abusing the file replace API. Rated as Medium severity with a CVSS score of 4.1, the vulnerability has a network attack vector and low attack complexity, requiring high privileges but no user interaction, resulting in a low integrity impact. There is no evidence of active exploitation, and no public exploit code is available on platforms like Metasploit or ExploitDB, with community discussion and media coverage being minimal.