{"id":"EUVD-2026-24273","enisaUuid":"253c1cd3-5314-3246-8cf5-9a8f29fd3fb5","description":"goshs is a SimpleHTTPServer written in Go. From 2.0.0-beta.4 to 2.0.0-beta.5, goshs leaks file-based ACL credentials through its public collaborator feed when the server is deployed without global basic auth. Requests to .goshs-protected folders are logged before authorization is enforced, and the collaborator websocket broadcasts raw request headers, including Authorization. An unauthenticated observer can capture a victim\u0027s folder-specific basic-auth header and replay it to read, upload, overwrite, and delete files inside the protected subtree. This vulnerability is fixed in 2.0.0-beta.6.","datePublished":"Apr 21, 2026, 7:40:37 PM","dateUpdated":"Apr 21, 2026, 8:05:26 PM","baseScore":7.7,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","references":"https://github.com/patrickhener/goshs/security/advisories/GHSA-7h3j-592v-jcrp\n","aliases":"CVE-2026-40885\nGHSA-7h3j-592v-jcrp\n","assigner":"GitHub_M","epss":0.31,"enisaIdProduct":[{"id":"8263c02f-9296-3735-9dc7-56be2ad8658e","product":{"name":"goshs","vendor":{"name":"patrickhener"}},"product_version":"2.0.0-beta.4, \u003c 2.0.0-beta.6"}],"enisaIdVendor":[{"id":"c5f29e71-9a5d-3739-b317-ddde6e8cd7be","vendor":{"name":"patrickhener"}}],"enisaIdVulnerability":[{"id":"365ee685-2422-3b90-a494-e83f6d1507e7","vulnerability":{"id":"CVE-2026-40885","description":"goshs is a SimpleHTTPServer written in Go. From 2.0.0-beta.4 to 2.0.0-beta.5, goshs leaks file-based ACL credentials through its public collaborator feed when the server is deployed without global basic auth. Requests to .goshs-protected folders are logged before authorization is enforced, and the collaborator websocket broadcasts raw request headers, including Authorization. An unauthenticated observer can capture a victim\u0027s folder-specific basic-auth header and replay it to read, upload, overwrite, and delete files inside the protected subtree. This vulnerability is fixed in 2.0.0-beta.6.","datePublished":"Apr 21, 2026, 7:40:37 PM","dateUpdated":"Apr 21, 2026, 8:05:26 PM","status":"PUBLISHED","baseScore":7.7,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","references":"https://github.com/patrickhener/goshs/security/advisories/GHSA-7h3j-592v-jcrp\n","enisa_id":"EUVD-2026-24273\n","assigner":"GitHub_M","epss":0.31,"dataProcessed":"Oct 27, 2026, 7:16:48 AM","vulnerabilityProduct":[{"id":"2056f0f8-33e1-31a9-ac6c-d552ee60bc6b","product":{"name":"goshs","vendor":{"name":"patrickhener"}},"product_version":"2.0.0-beta.4, \u003c 2.0.0-beta.6"}],"vulnerabilityVendor":[{"id":"afe6910e-3185-34bb-9c52-1ae13e76c721","vendor":{"name":"patrickhener"}}]}},{"id":"d0b4effb-b174-3610-bf21-791e63d05a60","vulnerability":{"id":"GHSA-7h3j-592v-jcrp","description":"goshs\u0027s public collaborator feed leaks .goshs ACL credentials and enables unauthorized access","datePublished":"Apr 14, 2026, 10:28:54 PM","dateUpdated":"Apr 27, 2026, 6:09:55 PM","baseScore":0.0,"references":"https://github.com/patrickhener/goshs/security/advisories/GHSA-7h3j-592v-jcrp\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-40885\nhttps://github.com/patrickhener/goshs\n","enisa_id":"EUVD-2026-24273\n","aliases":"CVE-2026-40885\nGHSA-7h3j-592v-jcrp\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 1:55:10 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}