goshs: File-based .goshs ACL authorization bypass via the ?bulk zip-download route (unauthenticated read; residual of CVE-2026-40189)

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-54719 · Microsoft / collected KEV context

GHSA-rmxw-pq4x-3fvh

GO-2026-6133

cve-program · CVE-2026-54719

• https://github.com/goshs-labs/goshs/security/advisories/GHSA-rmxw-pq4x-3fvh
• https://github.com/goshs-labs/goshs/commit/7cf911a26ace737e1a55b7dc073e307a25f7fd1d
• https://github.com/goshs-labs/goshs/releases/tag/v2.1.1

nvd · CVE-2026-54719

• https://github.com/goshs-labs/goshs/commit/7cf911a26ace737e1a55b7dc073e307a25f7fd1d
• https://github.com/goshs-labs/goshs/releases/tag/v2.1.1
• https://github.com/goshs-labs/goshs/security/advisories/GHSA-rmxw-pq4x-3fvh

osv · GHSA-rmxw-pq4x-3fvh

• https://github.com/goshs-labs/goshs/security/advisories/GHSA-rmxw-pq4x-3fvh
• https://github.com/goshs-labs/goshs/commit/7cf911a26ace737e1a55b7dc073e307a25f7fd1d
• https://github.com/goshs-labs/goshs
• https://github.com/goshs-labs/goshs/releases/tag/v2.1.1

osv · GO-2026-6133

• https://github.com/goshs-labs/goshs/security/advisories/GHSA-rmxw-pq4x-3fvh
• https://github.com/goshs-labs/goshs/commit/7cf911a26ace737e1a55b7dc073e307a25f7fd1d
• https://github.com/goshs-labs/goshs/releases/tag/v2.1.1

No related operational record is retained in the current change model.