goshs has a file-based ACL authorization bypass in goshs state-changing routes

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-40189 · Microsoft / collected KEV context

EUVD-2026-21591

GHSA-wvhv-qcqf-f3cx

GO-2026-5728

cve-program · CVE-2026-40189

• https://github.com/patrickhener/goshs/security/advisories/GHSA-wvhv-qcqf-f3cx
• https://github.com/patrickhener/goshs/commit/f212c4f4a126556bab008f79758e21a839ef2c0f
• https://github.com/patrickhener/goshs/releases/tag/v2.0.0-beta.4

euvd · EUVD-2026-21591

• https://github.com/patrickhener/goshs/security/advisories/GHSA-wvhv-qcqf-f3cx
• https://github.com/patrickhener/goshs/commit/f212c4f4a126556bab008f79758e21a839ef2c0f
• https://github.com/patrickhener/goshs/releases/tag/v2.0.0-beta.4

nvd · CVE-2026-40189

• https://github.com/patrickhener/goshs/commit/f212c4f4a126556bab008f79758e21a839ef2c0f
• https://github.com/patrickhener/goshs/releases/tag/v2.0.0-beta.4
• https://github.com/patrickhener/goshs/security/advisories/GHSA-wvhv-qcqf-f3cx

osv · GHSA-wvhv-qcqf-f3cx

• https://github.com/patrickhener/goshs/security/advisories/GHSA-wvhv-qcqf-f3cx
• https://nvd.nist.gov/vuln/detail/CVE-2026-40189
• https://github.com/patrickhener/goshs/commit/f212c4f4a126556bab008f79758e21a839ef2c0f
• https://github.com/patrickhener/goshs
• https://github.com/patrickhener/goshs/releases/tag/v2.0.0-beta.4

osv · GO-2026-5728

• https://github.com/patrickhener/goshs/security/advisories/GHSA-wvhv-qcqf-f3cx
• https://nvd.nist.gov/vuln/detail/CVE-2026-40189
• https://github.com/patrickhener/goshs/commit/f212c4f4a126556bab008f79758e21a839ef2c0f
• https://github.com/patrickhener/goshs/releases/tag/v2.0.0-beta.4

No related operational record is retained in the current change model.