{"id":"EUVD-2026-21591","enisaUuid":"fdb17d7a-9c48-3bf0-b597-b7efd6785f7f","description":"goshs is a SimpleHTTPServer written in Go. Prior to 2.0.0-beta.4, goshs enforces the documented per-folder .goshs ACL/basic-auth mechanism for directory listings and file reads, but it does not enforce the same authorization checks for state-changing routes. An unauthenticated attacker can upload files with PUT, upload files with multipart POST /upload, create directories with ?mkdir, and delete files with ?delete inside a .goshs-protected directory. By deleting the .goshs file itself, the attacker can remove the folder\u0027s auth policy and then access previously protected content without credentials. This results in a critical authorization bypass affecting confidentiality, integrity, and availability. This vulnerability is fixed in 2.0.0-beta.4.","datePublished":"Apr 10, 2026, 7:44:54 PM","dateUpdated":"Apr 13, 2026, 8:53:02 PM","baseScore":9.3,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","references":"https://github.com/patrickhener/goshs/security/advisories/GHSA-wvhv-qcqf-f3cx\nhttps://github.com/patrickhener/goshs/commit/f212c4f4a126556bab008f79758e21a839ef2c0f\nhttps://github.com/patrickhener/goshs/releases/tag/v2.0.0-beta.4\n","aliases":"CVE-2026-40189\nGHSA-wvhv-qcqf-f3cx\n","assigner":"GitHub_M","epss":0.64,"enisaIdProduct":[{"id":"fb60ed10-b245-3458-b024-ad9bbbaa81e0","product":{"name":"goshs","vendor":{"name":"patrickhener"}},"product_version":"\u003c 2.0.0-beta.4"}],"enisaIdVendor":[{"id":"39678dd4-2770-3a35-bc06-96781dc9121a","vendor":{"name":"patrickhener"}}],"enisaIdVulnerability":[{"id":"8934aed9-3e80-3a57-bfba-f34b7d04c707","vulnerability":{"id":"GHSA-wvhv-qcqf-f3cx","description":"goshs has a file-based ACL authorization bypass in goshs state-changing routes","datePublished":"Apr 10, 2026, 8:00:32 PM","dateUpdated":"Apr 15, 2026, 9:06:24 PM","baseScore":0.0,"references":"https://github.com/patrickhener/goshs/security/advisories/GHSA-wvhv-qcqf-f3cx\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-40189\nhttps://github.com/patrickhener/goshs/commit/f212c4f4a126556bab008f79758e21a839ef2c0f\nhttps://github.com/patrickhener/goshs\nhttps://github.com/patrickhener/goshs/releases/tag/v2.0.0-beta.4\n","enisa_id":"EUVD-2026-21591\n","aliases":"GHSA-wvhv-qcqf-f3cx\nCVE-2026-40189\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 1:59:37 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"ba8d5381-a7db-358a-b951-bd79ab925d7a","vulnerability":{"id":"CVE-2026-40189","description":"goshs is a SimpleHTTPServer written in Go. Prior to 2.0.0-beta.4, goshs enforces the documented per-folder .goshs ACL/basic-auth mechanism for directory listings and file reads, but it does not enforce the same authorization checks for state-changing routes. An unauthenticated attacker can upload files with PUT, upload files with multipart POST /upload, create directories with ?mkdir, and delete files with ?delete inside a .goshs-protected directory. By deleting the .goshs file itself, the attacker can remove the folder\u0027s auth policy and then access previously protected content without credentials. This results in a critical authorization bypass affecting confidentiality, integrity, and availability. This vulnerability is fixed in 2.0.0-beta.4.","datePublished":"Apr 10, 2026, 7:44:54 PM","dateUpdated":"Apr 13, 2026, 8:53:02 PM","status":"PUBLISHED","baseScore":9.3,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","references":"https://github.com/patrickhener/goshs/security/advisories/GHSA-wvhv-qcqf-f3cx\nhttps://github.com/patrickhener/goshs/commit/f212c4f4a126556bab008f79758e21a839ef2c0f\nhttps://github.com/patrickhener/goshs/releases/tag/v2.0.0-beta.4\n","enisa_id":"EUVD-2026-21591\n","assigner":"GitHub_M","epss":0.64,"dataProcessed":"Nov 1, 2026, 7:17:12 AM","vulnerabilityProduct":[{"id":"74fd526c-db81-3529-8ad2-db7577d1ab06","product":{"name":"goshs","vendor":{"name":"patrickhener"}},"product_version":"\u003c 2.0.0-beta.4"}],"vulnerabilityVendor":[{"id":"8d3c9973-6508-3283-8042-f2d1a575aacd","vendor":{"name":"patrickhener"}}]}}],"enisaIdAdvisory":[{"id":"bff61b03-cc85-353b-985b-8358db0b34f9","advisory":{"id":"openSUSE-SU-2026:10542-1","description":"goshs-2.0.0-1.1 on GA media","summary":"goshs-2.0.0-1.1 on GA media","datePublished":"Apr 14, 2026, 12:00:00 AM","dateUpdated":"Sep 17, 2026, 5:00:59 PM","baseScore":0.0,"references":"https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2026_10542-1.json\nhttps://www.suse.com/security/cve/CVE-2026-35392/\nhttps://www.suse.com/security/cve/CVE-2026-35393/\nhttps://www.suse.com/security/cve/CVE-2026-35471/\nhttps://www.suse.com/security/cve/CVE-2026-40188/\nhttps://www.suse.com/security/cve/CVE-2026-40189/\n","aliases":"CVE-2026-35392\nCVE-2026-35393\nCVE-2026-35471\nCVE-2026-40188\nCVE-2026-40189\n","source":{"id":21,"name":"csaf_opensuse"},"advisoryProduct":[{"id":"12ba212c-95a3-3f44-8a22-605d38a2eb14","product":{"name":"goshs-0:2.0.0-1.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"62cda1e6-fa4b-3141-9df0-ddfc5ea29fb8","product":{"name":"goshs-2.0.0-1.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"64c1a97f-a93d-316b-acd2-a091b137aa06","product":{"name":"goshs-2.0.0-1.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"680ba8b7-f375-3c37-b9a8-b2d540848fd4","product":{"name":"goshs-2.0.0-1.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"6eee01b4-7b33-3d92-87de-1d2318c1c4d6","product":{"name":"goshs-0:2.0.0-1.1.s390x","vendor":{"name":"SUSE"}}},{"id":"8694700f-150b-3439-8dda-487e0bae10cc","product":{"name":"goshs-2.0.0-1.1.s390x","vendor":{"name":"SUSE"}}},{"id":"a436d0e8-e0c2-3b0c-ad38-c4177ceee67b","product":{"name":"openSUSE Tumbleweed","vendor":{"name":"SUSE"}}},{"id":"ca3ee627-3653-3f38-afa1-4771ec8f1e6f","product":{"name":"goshs-0:2.0.0-1.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"ce618300-9bad-3e74-8b4f-31b2c4e78d5b","product":{"name":"goshs-0:2.0.0-1.1.ppc64le","vendor":{"name":"SUSE"}}}]}}]}